Add native Windows compatibility layer

src/secret_storage.py

@@ -24,6 +24,8 @@ from pathlib import Path
 
 from cryptography.fernet import Fernet, InvalidToken
 
+from core.platform_compat import safe_chmod
+
 logger = logging.getLogger(__name__)
 
 _KEY_PATH = Path(__file__).resolve().parent.parent / "data" / ".app_key"
@@ -37,10 +39,9 @@ def _load_or_create_key() -> bytes:
     _KEY_PATH.parent.mkdir(parents=True, exist_ok=True)
     key = Fernet.generate_key()
     _KEY_PATH.write_bytes(key)
-    try:
-        os.chmod(_KEY_PATH, 0o600)
-    except Exception:
-        pass
+    # POSIX: lock the key to 0o600. Windows: no-op (the user-profile data dir is
+    # already ACL-restricted); safe_chmod swallows both cases.
+    safe_chmod(_KEY_PATH, 0o600)
     logger.info(f"Generated new app key at {_KEY_PATH}")
     return key