port(upstream): #3381 - create credential store with owner-only permissions

[bloodf]

Summary

• What changed: Create credential store with owner-only permissions.
• Why it changed: Port fix(db): create credential store with owner-only permissions decolua/9router#3381 from the docs(campaigns): re-verify the 43 open-PR correctness rows against current main #508 reverification shortlist into DurinDoor.

Type

port(upstream) — the PR template has no port: checkbox. Conventional type is port, scope upstream.

• feat:
• fix:
• refactor:
• docs:
• ci:
• chore:

Scope

Upstream #3381: create credential store with owner-only permissions.
Head port/upstream-3381-db-file-permissions @ 1917b23c69d178d320b436766dd28d0134bd98bf. Base main.
Independent branch off main.
Dirty primary checkout untouched.

Production files:

• src/lib/dataDir.js
• src/lib/db/adapters/sqljsAdapter.js
• src/lib/db/backup.js
• src/lib/db/driver.js
• src/lib/db/paths.js

Test coverage

Focused specs:

• tests/unit/db-file-permissions.test.js

SHA-pinned local gate (lint, check:docs, check:registry-index, test:ci, build, commitlint). tests/__baseline__/known-fails.txt unchanged. Revert-proofed: focused specs went red after swapping production files back to the parent, then green after restore.

Doc coverage

Inline JSDoc / module-header comments at the port site: src/lib/dataDir.js, src/lib/db/adapters/sqljsAdapter.js, src/lib/db/backup.js, src/lib/db/driver.js, src/lib/db/paths.js.

Baseline impact

None.

Wire-format / migration concerns

None beyond this upstream change. Existing stored API keys, ~/.9router/, and X-Msh-Platform: 9router remain accepted.

Breaking changes

• No
• Yes — describe below:

Testing

• What was tested: the focused specs above plus one Node 20 full test:ci at 1917b23c69d178d320b436766dd28d0134bd98bf.
• Commands run: /tmp/gate-branch-v2.sh port/upstream-3381-db-file-permissions 1917b23c69d178d320b436766dd28d0134bd98bf; npx commitlint --from=origin/main --to=1917b23c69d178d320b436766dd28d0134bd98bf.
• Evidence: GATE_PASS port/upstream-3381-db-file-permissions 1917b23

Checklist

• Tests added or updated for behavioral changes
• No new dependencies without explicit justification
• Conventional commit used (port(upstream):)
• CHANGELOG updated if this change is user-facing
• No secrets, keys, credentials, or tokens committed