storage-sqlite: init creates the database and WAL sidecars at 0644; only serve tightens the main file #657

extenddb init --backend sqlite leaves the database file and its WAL sidecars at the process umask (0644 here), while the generated extenddb.toml and the .lock file are 0600:

-rw------- extenddb.toml
-rw-r--r-- x.sqlite
-rw------- x.sqlite.lock
-rw-r--r-- x.sqlite-shm
-rw-r--r-- x.sqlite-wal

storage-sqlite/src/store.rs (around line 150) chmods the file and its -wal/-shm sidecars to 0600 after the pool connects, but only for files that exist at that moment, and the observed state after init is 0644 for all three: either init reaches the database through a path that does not run that code, or the sidecars are created by the first write after the chmod ran. The database holds the encryption key beside the secrets it protects, as the comment there says, and the project keeps the database and its sidecars at 0600 (the lock file was fixed to that in #391).

Expected: init creates the database with mode(0o600) before SQLite opens it, and the sidecars are created 0600 too (pre-create them, or chmod after the first checkpoint rather than at connect). A test on the modes after init and after a first write.

Reproduction (main cf321f0, umask 022): extenddb init --backend sqlite --sqlite-path x.sqlite --output extenddb.toml, then ls -l.