fix: purge keychain credentials on profile delete, atomic owner-only secret writes, zeroize derived keys

- Secrets::delete_profile removes every profile credential kind from the OS
  keychain as well as the vault (previously only the vault was purged, so
  keychain passwords/tokens outlived the profile).
- write_private writes to a sibling temp file and renames it into place, so a
  crash mid-write cannot truncate the vault or an export, and a pre-existing
  world-readable file is replaced rather than reused.
- Argon2-derived vault/export keys are Zeroizing and wiped on drop.
- Recordings (which capture typed input), JSON exports and --data-dir
  directories are created owner-only.

rust/app/src/main.rs

@@ -82,8 +82,7 @@ fn main() -> eframe::Result {
     let config = match data_dir {
         Some(d) => {
             let c = AppConfig::in_dir(d.into());
-            std::fs::create_dir_all(&c.vault_dir).ok();
-            Ok(c)
+            nexus_core::config::create_private_dir(&c.data_dir).and_then(|_| nexus_core::config::create_private_dir(&c.vault_dir)).map(|_| c)
         }
         None => AppConfig::load(),
     };

rust/app/src/transfer.rs

@@ -210,7 +210,12 @@ impl Transfer {
                             .add_filter("JSON", &["json"])
                             .save_file()
                     {
-                        match s.svc.export_json(*include_secrets).map_err(|e| e.to_string()).and_then(|j| std::fs::write(&path, j).map_err(|e| e.to_string())) {
+                        match s
+                            .svc
+                            .export_json(*include_secrets)
+                            .map_err(|e| e.to_string())
+                            .and_then(|j| nexus_core::secrets::write_private(&path, j.as_bytes()).map_err(|e| e.to_string()))
+                        {
                             Ok(()) => {
                                 s.success(format!("Exported {} profile(s) to {}", s.profiles.len(), path.display()));
                                 close = true;