Add 32 tests covering:
- Save/Load round-trip for all state types (domains, hostnames, ports, certificates)
- Atomic write verification (no leftover temp files)
- PortState.UnmarshalJSON backward compatibility (old single-hostname format)
- Missing, corrupt, and empty state file handling
- Permission error handling (skipped when running as root)
- All getter/setter/delete methods for every state type
- GetSnapshot returns a value copy
- GetAllPortKeys enumeration
- Concurrent read/write safety with race detection
- Concurrent Save/Load safety
- File permission verification (0600)
- Multiple saves overwrite previous state
- LastUpdated timestamp updates on save
- Error field round-trips for certificates and hostnames
- Snapshot version correctness
Also adds NewForTestWithDataDir() helper for tests requiring file persistence.
Closes#70