fix(security): harden credential storage and transmission (#369)

## Problem

Credential and cookie files were world-readable (0644), passwords
transited via `CP_CREDENTIALS` env var (visible in `/proc/PID/environ`),
and Kattis/USACO echoed passwords back through stdout unnecessarily.

## Solution

Set 0600 permissions on `cp-nvim.json` and `cookies.json` after every
write, pass credentials via stdin pipe instead of env var, and stop
emitting passwords in ndjson from Kattis/USACO `LoginResult` (CSES token
emission unchanged).

plugin/cp.lua

@@ -43,6 +43,10 @@ end, {
       vim.list_extend(candidates, platforms)
       table.insert(candidates, 'cache')
       table.insert(candidates, 'pick')
+      if platform then
+        table.insert(candidates, 'login')
+        table.insert(candidates, 'logout')
+      end
       if platform and contest_id then
         vim.list_extend(
           candidates,