fix(store): write the session file with 0600 like the rest of the store

[leemour]

What

session.json is the only credential file in the store left at the process umask — on a default umask it is created 0644. Everything else the store writes is explicit: config.json, account.json and the account registry are 0600, and their directories are 0700 (core/accounts.js).

The difference exists because mtcute writes the session file, not tgcli, so the store's own mode discipline never reaches it. This applies a chmod after a successful login, where the file is known to exist.

Severity: consistency, not a live hole

Worth being precise, since a permissions patch invites the wrong reading. Nothing is exposed today — the enclosing directories are 0700, so the file mode is never what stands between the auth key and another user.

It matters where the directory mode stops carrying the guarantee: a store placed on a shared or synced volume, a backup or archive that preserves file modes but recreates directories, or an environment with a relaxed umask. In those cases the file mode is the only thing left, and right now it is 0644.

Details

• Runs on the success path of login(), so it also repairs stores created by earlier versions.
• A missing or foreign-owned session file is ignored rather than failing the login.
• npx vitest run — 299 passed, 1 skipped, 19 files. Two new tests: narrowing a 0644 file, and not throwing when the file is absent.

Split out from #31 as suggested there; the two changes are unrelated.