fix: deploy script must set correct permissions on secrets.env

[quanyeomans]

Problem

The deploy script does not create or set permissions on /opt/kairix/secrets.env. If an operator creates this file manually, it may be world-readable (mode 644), exposing API keys and passwords to all local users.

Required Permissions

-rw-r----- root:<service-group>  /opt/kairix/secrets.env

Mode 640: readable by root and the service group, not world-readable.

Proposed Fix

The deploy script should:

1. Create /opt/kairix/secrets.env as an empty file if it doesn't exist
2. Set chmod 640 /opt/kairix/secrets.env
3. Set chown root:<kairix-service-group> /opt/kairix/secrets.env
4. Ensure the kairix service user is a member of that group

If running without a dedicated service user, default to chmod 600 (owner-only).

The secret fetching script (issue #28) should apply these permissions after writing.

Acceptance Criteria

• After deploy, stat /opt/kairix/secrets.env shows mode 640 or 600
• File is not world-readable
• Service account can read the file (is in the owning group)
• Deploy script errors or warns if it cannot set the correct permissions