feat: complete nx9-wg v0.8.0 platform

crates/nx9-wg-api/tests/test_auth_subsystem.rs

@@ -64,6 +64,19 @@ async fn test_admin_bootstrap_all_sources_and_rejection() {
     let gen_pw = res3.generated_plaintext.unwrap();
     let written = std::fs::read_to_string(gen_file.path()).expect("read gen");
     assert_eq!(written, gen_pw);
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let perms = std::fs::metadata(gen_file.path())
+            .expect("metadata")
+            .permissions();
+        assert_eq!(
+            perms.mode() & 0o777,
+            0o600,
+            "Password file permissions must be 0600"
+        );
+    }
 }
 
 #[tokio::test]