fix(security): harden credential storage and transmission (#369)

## Problem

Credential and cookie files were world-readable (0644), passwords
transited via `CP_CREDENTIALS` env var (visible in `/proc/PID/environ`),
and Kattis/USACO echoed passwords back through stdout unnecessarily.

## Solution

Set 0600 permissions on `cp-nvim.json` and `cookies.json` after every
write, pass credentials via stdin pipe instead of env var, and stop
emitting passwords in ndjson from Kattis/USACO `LoginResult` (CSES token
emission unchanged).

scrapers/base.py

@@ -36,6 +36,7 @@ def save_platform_cookies(platform: str, data: Any) -> None:
         existing = {}
     existing[platform] = data
     _COOKIE_FILE.write_text(json.dumps(existing))
+    _COOKIE_FILE.chmod(0o600)
 
 
 def clear_platform_cookies(platform: str) -> None:
@@ -43,6 +44,7 @@ def clear_platform_cookies(platform: str) -> None:
         existing = json.loads(_COOKIE_FILE.read_text())
         existing.pop(platform, None)
         _COOKIE_FILE.write_text(json.dumps(existing))
+        _COOKIE_FILE.chmod(0o600)
     except Exception:
         pass
 
@@ -160,7 +162,7 @@ class BaseScraper(ABC):
                         ).model_dump_json()
                     )
                     return 1
-                creds_raw = os.environ.get("CP_CREDENTIALS", "{}")
+                creds_raw = sys.stdin.read()
                 try:
                     credentials = json.loads(creds_raw)
                 except json.JSONDecodeError:
@@ -173,7 +175,7 @@ class BaseScraper(ABC):
                 return 0 if result.success else 1
 
             case "login":
-                creds_raw = os.environ.get("CP_CREDENTIALS", "{}")
+                creds_raw = sys.stdin.read()
                 try:
                     credentials = json.loads(creds_raw)
                 except json.JSONDecodeError:

scrapers/kattis.py

@@ -415,7 +415,6 @@ class KattisScraper(BaseScraper):
                     return LoginResult(
                         success=True,
                         error="",
-                        credentials={"username": username, "password": password},
                     )
 
             print(json.dumps({"status": "logging_in"}), flush=True)
@@ -426,7 +425,6 @@ class KattisScraper(BaseScraper):
         return LoginResult(
             success=True,
             error="",
-            credentials={"username": username, "password": password},
         )
 
 

scrapers/usaco.py

@@ -533,7 +533,6 @@ class USACOScraper(BaseScraper):
                     return LoginResult(
                         success=True,
                         error="",
-                        credentials={"username": username, "password": password},
                     )
 
             print(json.dumps({"status": "logging_in"}), flush=True)
@@ -549,7 +548,6 @@ class USACOScraper(BaseScraper):
         return LoginResult(
             success=True,
             error="",
-            credentials={"username": username, "password": password},
         )