fix: restrict ~/.eigent env files to owner-only (0600)

[BetterAndBetterII]

Summary

Credential-bearing .env files under ~/.eigent were left at the process umask (often 0644) after Electron writeFileSync updates. getEnvPath only applied chmod 0600 on the copy-from-default create path, so later writes stayed world-readable.

Harden create and load paths on POSIX so secrets stay owner-readable:

• Backend: restrict permissions when loading ~/.eigent env files / resetting to the default path
• Electron: writeEnvFile writes with mode 0600 and re-chmods existing files; getEnvPath tightens existing user env files

Fixes #1670

Test plan

• Backend pytest: existing 0644 ~/.eigent env files become 0600 on load/reset; repo-local .env left alone; chmod failure does not block load
• Electron vitest: getEnvPath / writeEnvFile enforce 0600 on create and update