The local index lists every backed-up path and chunk hash, but its file
mode was left to the SQLite driver and the umask, so under a typical 022
umask a fresh index (and its -wal/-shm side files) landed world-readable.
The snapshot export copied the index to snapshot.db with a permissive
create as well.
provideDatabase now calls ensureIndexFileMode before opening the driver:
it creates the index 0600 if missing and chmods an existing one to 0600.
Doing this before the driver opens the file matters because SQLite gives
its -wal and -shm files the mode of the main database file. The export
copy is now created 0600 instead of via the umask-dependent default.
Tests under umask 022 cover a fresh index, an existing 0644 index in a
0755 directory, and the export copy, asserting each ends up 0600.
Model: opus-4-8
