fix(auth): write the shared API-key store world-readable so other services see key changes

The key store holds only SHA-256 hashes + metadata (no plaintext keys) and is
read by other services in their own containers running as different non-root
uids. saveLocked wrote it 0600, so when the backoffice pod (running as root)
minted or revoked a key the file became root-owned 0600 — unreadable to the
ledger/cart services, freezing their mtime-reload snapshots: new keys 401'd
and revocations never took effect. Write 0644 so every reader reloads.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

auth/apikey.go

@@ -166,7 +166,12 @@ func (s *KeyStore) saveLocked() error {
 		return err
 	}
 	tmp := s.path + ".tmp"
-	if err := os.WriteFile(tmp, raw, 0o600); err != nil {
+	// 0644, not 0600: the store holds only SHA-256 hashes + metadata (no
+	// plaintext keys) and is read by OTHER services in their own containers
+	// (they run as different, non-root uids), so the written file must be
+	// world-readable. A 0600 file owned by the writing pod's uid would go
+	// unreadable to them and freeze their ReloadIfChanged snapshots.
+	if err := os.WriteFile(tmp, raw, 0o644); err != nil {
 		return err
 	}
 	return os.Rename(tmp, s.path)