write secret and key files atomically with their final mode

Each of these wrote its file in place (or set the mode after the
write), so a write cut short by a kill or a full disk left a partial
file behind, and some secrets existed for a moment at umask mode:

- swarm-authelia/swarm-grafana/hive-forge/swarm-bao generators: a
  partial file passed the `-s`/`-e` guard and was kept forever. They now
  capture the value first and land it with `atomic_write_secret`.
- swarm-controller webhook secret: a truncated file failed the 64-hex
  check and the secret was regenerated, out of step with the forge
  hooks. It is now written 0600 to a sibling temp, fsynced, renamed.
- hive-c0re htpasswd: the temp is now fsynced and set 0644 before the
  rename, like the sibling agents.conf writer, instead of relying on
  c0re's umask.
- hivectl wg init: the private key is created 0400 in a temp and
  renamed, instead of written at umask mode and chmod'ed after.

Closes #5068

nix/host-modules/swarm-authelia.nix

@@ -91,6 +91,7 @@ let
   unitName = lib.removeSuffix ".service" cfg.unit;
   instance = lib.removePrefix "authelia-" unitName;
   stateDir = "/var/lib/${unitName}";
+  atomicWriteSecret = import ./lib/atomic-write-secret.nix { };
 
   caTrust = import ./lib/hive-ca-trust.nix {
     inherit lib gatewayCfg;
@@ -837,6 +838,8 @@ in
             script = ''
               set -euo pipefail
 
+              ${atomicWriteSecret}
+
               # Each is generated once and never rotated here: the
               # session and storage keys are load-bearing for data
               # already written (sessions, the encrypted store), so
@@ -844,7 +847,8 @@ in
               for f in ${lib.concatStringsSep " " randomKeys}; do
                 p=${lib.escapeShellArg stateDir}/"$f".key
                 if [ ! -s "$p" ]; then
-                  head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n' > "$p"
+                  value=$(head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n')
+                  atomic_write_secret 0600 "" "$p" "$value"
                   echo "generated $p"
                 fi
                 chmod 0600 "$p"