fix(security): harden credential storage and transmission (#369)

## Problem

Credential and cookie files were world-readable (0644), passwords
transited via `CP_CREDENTIALS` env var (visible in `/proc/PID/environ`),
and Kattis/USACO echoed passwords back through stdout unnecessarily.

## Solution

Set 0600 permissions on `cp-nvim.json` and `cookies.json` after every
write, pass credentials via stdin pipe instead of env var, and stop
emitting passwords in ndjson from Kattis/USACO `LoginResult` (CSES token
emission unchanged).

doc/cp.nvim.txt

@@ -453,6 +453,7 @@ COMMANDS                                                         *cp-commands*
                                 any previously saved credentials.
                                 If [platform] is omitted, uses the active platform.
                                 Examples: >
+                                    :CP login
                                     :CP login atcoder
                                     :CP login codeforces
 <
@@ -460,6 +461,7 @@ COMMANDS                                                         *cp-commands*
                                 Remove stored credentials for a platform.
                                 If [platform] is omitted, uses the active platform.
                                 Examples: >
+                                    :CP logout
                                     :CP logout atcoder
 <
             :CP {platform} signup