gnd: Restrict deploy key config permissions

[erayack]

1. What & Why

gnd auth stores deploy keys in ~/.graph-cli.json. Before this change:

• Newly created files could inherit permissive mode bits.
• Existing group/world-readable files remained permissive after later writes.
• Missing-home and other auth configuration errors could be discarded by gnd create and gnd remove, causing those mutation requests to proceed without authentication.

On Unix, auth config writes now create files with mode 0600 and explicitly restrict existing files before modifying their contents. Home-directory lookup is fallible rather than panicking, and create/remove propagate stored-key lookup errors instead of converting them into anonymous requests.

2. Implementation and Behavior

Permission handling remains within gnd/src/commands/auth.rs:

• Unix: open/create without truncating, set mode 0600, truncate, then write compact JSON.
• Non-Unix: retain the existing fs::write behavior.
• Write ordering: permissions are restricted before truncation so a permission-change failure leaves existing deploy keys intact.

Authentication resolution now consistently:

1. Uses an explicit --access-token when supplied.
2. Otherwise loads the stored deploy key.
3. Preserves Ok(None) as a legitimate unauthenticated configuration.
4. Propagates configuration lookup failures before constructing GraphNodeClient.

gnd deploy already propagated stored-key lookup errors and is unchanged. Existing config location, JSON format, node URL normalization, map merge behavior, CLI flags, and public APIs remain unchanged.

3. Review Guide

Suggested review order:

1. gnd/src/commands/auth.rs
   • Verify new and existing Unix files end with mode 0600.
   • Confirm permissions are narrowed before existing contents are truncated.
   • Check fallible home-directory lookup and access-token resolution.
2. gnd/src/commands/create.rs
   • Confirm auth configuration errors stop the command before client construction.
3. gnd/src/commands/remove.rs
   • Confirm the same behavior for the destructive remove operation.
4. Tests in gnd/src/commands/auth.rs
   • Confirm permission behavior, existing-entry preservation, error propagation, Ok(None), and explicit-token precedence.

Reviewer checklist

• New Unix auth files are created as 0600.
• Existing permissive files are narrowed before truncation.
• Existing config entries survive updates.
• Create/remove do not downgrade configuration errors to anonymous requests.
• Explicit access tokens bypass stored-key lookup.
• Ok(None) remains a valid unauthenticated result.
• The non-Unix fallback remains unchanged.

4. Risk and Non-Goals

The main risk is filesystem behavior across platforms. Unix behavior is covered directly; non-Unix continues using the previous implementation.

No atomic-write, locking, symlink-policy, directory-creation, credential-format, schema, CLI flag, or broader authentication-policy changes are intended.

5. Validation

• just format
• just lint
• just check --release
• cargo test -p gnd commands::auth — 9 passed
• cargo test -p gnd --lib — 273 passed

The full workspace just test-unit run requires the externally managed test configuration and services and was not available locally.