fix(security): harden credential storage and transmission

Problem: credential and cookie files were world-readable (0644),
passwords transited via `CP_CREDENTIALS` env var (visible in
`/proc/PID/environ`), and Kattis/USACO echoed passwords back
through stdout unnecessarily.

Solution: set 0600 permissions on `cp-nvim.json` and `cookies.json`
after every write, pass credentials via stdin pipe instead of env
var, and stop emitting passwords in ndjson from Kattis/USACO
`LoginResult` (CSES token emission unchanged).

scrapers/usaco.py

@@ -533,7 +533,6 @@ class USACOScraper(BaseScraper):
                     return LoginResult(
                         success=True,
                         error="",
-                        credentials={"username": username, "password": password},
                     )
 
             print(json.dumps({"status": "logging_in"}), flush=True)
@@ -549,7 +548,6 @@ class USACOScraper(BaseScraper):
         return LoginResult(
             success=True,
             error="",
-            credentials={"username": username, "password": password},
         )