fix(security): harden credential storage and transmission (#369)

## Problem

Credential and cookie files were world-readable (0644), passwords
transited via `CP_CREDENTIALS` env var (visible in `/proc/PID/environ`),
and Kattis/USACO echoed passwords back through stdout unnecessarily.

## Solution

Set 0600 permissions on `cp-nvim.json` and `cookies.json` after every
write, pass credentials via stdin pipe instead of env var, and stop
emitting passwords in ndjson from Kattis/USACO `LoginResult` (CSES token
emission unchanged).

scrapers/usaco.py

@@ -533,7 +533,6 @@ class USACOScraper(BaseScraper):
                     return LoginResult(
                         success=True,
                         error="",
-                        credentials={"username": username, "password": password},
                     )
 
             print(json.dumps({"status": "logging_in"}), flush=True)
@@ -549,7 +548,6 @@ class USACOScraper(BaseScraper):
         return LoginResult(
             success=True,
             error="",
-            credentials={"username": username, "password": password},
         )