fix(wg): umask 077 in serve-request + UMask in unit — no 0644 race on key files (security review)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/wg/clusev-wg-request.service

@@ -9,6 +9,8 @@ After=docker.service
 [Service]
 Type=oneshot
 User=root
+# Result/QR files carry a freshly-minted private key — keep them 0600 from birth (run/ is 0775).
+UMask=0077
 Environment=CLUSEV_DIR=/home/nexxo/clusev
 WorkingDirectory=/home/nexxo/clusev
 ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh serve-request

docker/wg/clusev-wg.sh

@@ -311,6 +311,7 @@ _write_result() {
 # Process one UI write-request. Whitelists the action + re-validates every arg HOST-SIDE.
 cmd_serve_request() {
   need_root serve-request
+  umask 077   # result + QR sidecar carry a private key — born 0600, never world-readable in run/ (0775)
   local req="${RUN_DIR}/wg-request.json" work="${RUN_DIR}/wg-request.processing"
   [ -f "$req" ] || return 0
   mv -f "$req" "$work" 2>/dev/null || return 0