file_store: new stores are readable by other users under common umasks

**Describe the bug**

`bdk_file_store::Store::create` uses default file-creation permissions. On Unix with `umask 022`, a new store is `0644`. If its parent directories are accessible, other local users can read the persisted changesets. The creation docs do not explain this behavior or the caller's permission responsibilities. The SQLite persistence docs likewise omit guidance for caller-created database files.

This issue was found by AI.

**To Reproduce**

Add this as `crates/file_store/tests/permissions.rs`, then run `(umask 022 && cargo test -p bdk_file_store --test permissions -- --nocapture)`:

```rust
#[cfg(unix)]
#[test]
fn new_store_permissions() {
use std::{collections::BTreeSet, os::unix::fs::PermissionsExt};

let dir = tempfile::tempdir().unwrap();
let path = dir.path().join("wallet.store");
let _store = bdk_file_store::Store::>::create(b"test", &path).unwrap();
let mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;

assert_eq!(mode & 0o077, 0, "store file mode: {mode:04o}");
}
```

The assertion fails with `store file mode: 0644`.

**Expected behavior**

Applications should be able to persist wallet data without unintentionally granting access to other local users, with clear permission defaults and caller responsibilities.

Start with bdk_file_store::Store::create and add the proposed test at crates/file_store/tests/permissions.rs. Run `(umask 022 && cargo test -p bdk_file_store --test permissions -- --nocapture)` to reproduce the 0644 mode. Review the file-store creation and SQLite persistence documentation, then confirm the test passes and the permission behavior and caller responsibilities are documented.

Written by the indexing model from the issue text.