#2574 setup, serve: a run config that holds an API key is readable by its owner only (0600) (#1919)

Descripción

One item of #1919: "the run config holds the API key and is written with the default umask ... Expected: mode 0600
on POSIX."

**What it changes.** On Linux and macOS, `strata-<model>.json` was created with the default umask (0644 with the
usual 022), so every user of the PC could read `"api_key"`, the key that guards a server opened with `--host
0.0.0.0`. Now, when the new or the earlier config has a non-empty `api_key`, these are created 0600 from their first
byte (through `os.open(..., 0o600)` plus `fchmod`, so a `.tmp` or `.bak` left from an earlier run is tightened too):
- `setup.write_config` (every config setup writes, including `repoint_config`'s);
- `write_setup_config`'s `strata-<model>.json.bak` of the earlier config;
- the web page's Model settings save (`serve/runconfig.save`) and its `.bak`.

**What it leaves alone.** A config without a key (`"api_key"` missing or `""`): the same bytes and the same mode
as before. Windows: untouched. What is in the file. `docker-entrypoint.sh`: its `cp -f` after a re-setup keeps the
mode of an existing volume file, so a volume config from a key-less install stays 0644 until setup or the page
writes it again. Two consequences a user may notice: in the container (setup and the server run as root) a host user
needs sudo to read a key-holding config on the volume; and a config shared between accounts, or read by another
service user, is no longer readable by them once it holds a key. Removing the key in a save leaves that save 0600.

**How it was checked.**
- `tools/test_setup_risk.py` `test_a_config_with_an_api_key_is_the_owner_s_only_1919`: with umask 022, a config
  with a key is 0600 (also over a 0644 `.tmp` left behind), one without is 0644, and `write_setup_config`'s `.bak`
  of a key-holding config is 0600 with the earlier content.
- `serve/test_runconfig.py`: a save from the page keeps a key-holding config and its `.bak` 0600; a config without a
  key (the fixture's `"api_key": ""`) is saved 0644 as before.
- On `upstream/main` the two key tests fail and the no-key test passes.
- `serve.test_runconfig`, `serve.test_security`, `tools/test_setup_risk.py`, `test_setup_choices.py`,
  `test_setup_menu.py`, `test_setup_unsloth.py`, `test_setup_qwen36.py`, `test_setup_config.py`,
  `test_setup_configs.py`: OK. Python 3.14, Ubuntu (Linux 7.0); not run on macOS or Windows.

🤖 Generated with [Claude Code](https://claude.com/claude-code)