Fix: prevent race condition in backup file permissions

This change replaces insecure file writes followed by `os.chmod` with `utils.atomic_write.atomic_write` in `portable_backup.py` and `manager.py`. The `atomic_write` function uses `tempfile.mkstemp` to ensure files are created with restrictive permissions (0o600) from the start, eliminating the race condition where sensitive data could be briefly world-readable.

- Updated `export_backup` in `portable_backup.py` to use `atomic_write` for both the JSON backup and its encrypted counterpart.
- Updated `handle_export_totp_codes` in `manager.py` to use `atomic_write` for TOTP exports.
- Added `test_atomic_write_perms.py` to verify permissions behavior (though it relies on system-specific `mkstemp` behavior).
- Verified fix by running existing tests `test_portable_backup.py`, `test_export_totp_codes.py`, and `test_atomic_write.py`.

Co-authored-by: PR0M3TH3AN <[email protected]>

test_atomic_write_perms.py

@@ -0,0 +1,34 @@
+
+import sys
+from pathlib import Path
+
+# Add src/utils to path to import atomic_write directly
+sys.path.append(str(Path("src/utils").resolve()))
+
+from atomic_write import atomic_write
+import os
+import stat
+
+def test_atomic_write_permissions():
+    test_file = Path("test_permissions.txt")
+    if test_file.exists():
+        test_file.unlink()
+
+    def write_op(f):
+        f.write("content")
+
+    atomic_write(test_file, write_op)
+
+    st = test_file.stat()
+    mode = stat.S_IMODE(st.st_mode)
+    print(f"File permissions: {oct(mode)}")
+
+    if mode == 0o600:
+        print("SUCCESS: Permissions are 0o600")
+    else:
+        print(f"FAILURE: Permissions are {oct(mode)}")
+
+    test_file.unlink()
+
+if __name__ == "__main__":
+    test_atomic_write_permissions()