Store token files with `0600` permissions

### Problem

Beets stores authentication/token files that may contain sensitive credentials. These files should not be readable or writable by other users on the system.

Currently, token files may be created using the default filesystem permissions, which can result in permissions that are more permissive than intended depending on the user's `umask`.

### Expected behavior

Token files should always be created with permissions:

```text
0600
```

This means:

* Owner: read + write
* Group: no access
* Others: no access

The implementation should explicitly set the file mode rather than relying solely on the process `umask`.

### Proposed solution

When creating or writing token files, ensure they are created with `0600` permissions. Ideally, the file should be created atomically with the desired mode to avoid a window where the file has broader permissions.

For existing token files, consider restricting their permissions to `0600` when they are accessed or updated.

Locate the token-file creation and update paths, then inspect how file permissions are currently applied. Verify the behavior with different umasks and existing token files. Done means newly created and accessed or updated token files are restricted to 0600 without a permissive creation window.

Written by the indexing model from the issue text.