Make the SQLite data directory and DB files private (0700/0600)

[adamXbot]

Summary

The data directory was created with umask permissions (typically 0755) and better-sqlite3 created privacy.db + its WAL/SHM sidecars 0644 — world-readable on multi-user machines, for a file holding the user's full app inventory, notes, and AI provider key. The repo already sets 0600 on the backup signing key; this brings the database itself up to the same standard.

• lib/db.ts — the data dir is created with mode: 0o700, and every open runs tightenDataPermissions(): 0700 on the dir, 0600 on privacy.db/-wal/-shm. It runs before the journal_mode=WAL pragma so freshly-created sidecar files inherit 0600 (SQLite copies the main DB file's mode). Best-effort by design: a no-op on Windows, never fatal to opening the DB. Existing loose installs are tightened on their next boot — no migration step needed.
• src-tauri/src/sidecar.rs — cfg(unix) 0700 on the data dir at creation, so a desktop first-boot is never world-listable even before the Node side opens the DB.
• .github/workflows/ci.yml — the compose-smoke bind-mount assertion becomes sudo test -f data/privacy.db: the runner user can no longer stat inside a 0700 dir owned by uid 100, which is the intended lockdown, and the assertion must not depend on its absence.
• AGENTS.md — documents the permissions contract (including that bind-mount hosts now need sudo to inspect ./data).

Deployment impact

• Docker named volume (default): none — the audit user (uid 100) owns /app/data and keeps full access.
• Docker bind mount (opt-in): the host user now needs sudo to look inside ./data. Backups via docker compose cp web:/app/data ./data-backup are unaffected.
• Desktop (Tauri) and bare next start: files become private to the owning user; no behaviour change for the app itself.

Verification

• tests/app/data-dir-permissions.test.ts pins three paths: fresh install, loose-install migration (chmod back to 0755/0644, tighten, re-assert), and WAL-sidecar inheritance after a write. POSIX-only, skipped on Windows.
• 445 unit tests, 0 failures; pnpm typecheck + pnpm lint clean; cargo check --no-default-features --locked clean.
• The Docker paths are exercised by the compose-smoke job in this PR's own CI run (both volume legs).

🤖 Generated with Claude Code

[adamXbot]

Second commit (79daeb5) is the same fix(deps) advisory patch as on #134 — cherry-picked so this branch passes the pnpm audit --prod gate independently of #134's merge order. Whichever PR merges second rebases cleanly (identical patches are skipped).

🤖 Generated with Claude Code