Harden API key file loading

internal/app/secrets_env_posix.go

@@ -0,0 +1,22 @@
+//go:build !windows
+
+package app
+
+import (
+	"fmt"
+	"os"
+)
+
+func validateSecretDirectoryPrivacy(info os.FileInfo) error {
+	if info.Mode().Perm()&^secretDirectoryPrivateMode != 0 {
+		return fmt.Errorf("secret directory mode %04o grants group or other access; require %04o", info.Mode().Perm(), secretDirectoryPrivateMode)
+	}
+	return nil
+}
+
+func validateSecretFilePrivacy(info os.FileInfo) error {
+	if info.Mode().Perm()&^secretFilePrivateMode != 0 {
+		return fmt.Errorf("secret file mode %04o grants group or other access; require %04o", info.Mode().Perm(), secretFilePrivateMode)
+	}
+	return nil
+}