fix: protect MCP config credentials

[vycdev2]

Summary

• create the generated MCP config with owner-only permissions
• tighten permissions on existing config files before writing authentication credentials
• cover permissive pre-existing config files with a regression test

Verification

• npm run build — passed
• node --test tests/mcpHttp.test.mjs — passed (3 tests)
• npm test — passed (195 tests)
• git diff --check — passed

Risk

• Low: the write path and JSON format are unchanged; only the file mode is tightened to 0600.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.