fix(auth): stop losing preserved plaintext, and claim the hand-off file atomically

Round 19 found real data loss rather than process noise, in two places.

**An unrelated settings edit destroyed the secret the durability gate had
just preserved.** The GET migration withholds its strip for a session-scoped
store, so `mcp.json` stays the durable copy — but the POST/PUT paths always
wrote the stripped shape. The GET also returns the rehydrated secret to the
settings form, which resends the whole object when the user changes anything,
so editing a timeout wrote the stripped entry, moved the only durable copy
into RAM, and lost it at exit. Every operation reported success. The client
config had the identical shape: the read-path guard was there, the write path
had none, and saving a CIMD URL did the same thing to the IdP client secret.

Both write paths now agree with their read paths: while the store cannot
outlive the process, the file stays the durable copy.

**The hand-off's delete is no longer a check-to-delete race.** Re-reading
immediately before `rm` caught writes that had already landed and was blind to
the one arriving between the check and the delete — destroying a *later*,
already-successful write, which is worse than the optimistic-write residual
and, unlike it, fixable without a lock. The file is claimed by an atomic
rename before anything reads it, so the migration operates on a snapshot
nobody else can reach and a writer that recreates `secrets.json` is simply
untouched.

Claiming introduced a failure mode the existing tests caught immediately: a
migration that aborts must not leave the secrets stranded at the staging path.
The snapshot is restored on any incomplete outcome, and when the live path has
been recreated in the meantime it is left in place with its location logged —
an operator-visible orphan is recoverable; clobbering someone's write is not.

Also:

- **`setMany`**, the write-side twin of `getMany`. `set` costs a whole-file
  read-decrypt-encrypt-write-verify cycle per call, and the settings form
  resends a server's full `env` map on any edit, so a 10-variable stdio server
  spent ~30 scrypt derivations saving an unrelated change. One cycle now; the
  keychain keeps its parallel individual writes.
- **A doc that contradicted its function.** `readOnDiskEncryption` still said
  it "never decrypts, so it needs no passphrase" — round 12 made it
  authenticate precisely because structure is not access.

Full `npm run ci` green, staged tree verified before running it.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/client/node-persistence.test.ts

@@ -224,3 +224,60 @@ describe("client node-persistence", () => {
     ).toBeNull();
   });
 });
+
+describe("session-scoped store keeps client.json durable (#1950 review r19)", () => {
+  it("does not strip the IdP secret when the store cannot outlive the process", async () => {
+    // The read-path migration already withheld its strip for a session
+    // store, but the write path did not — and `readClientConfigStore` hands
+    // the rehydrated secret to the form, which resends the whole object when
+    // an unrelated field changes. Saving a CIMD URL therefore moved the only
+    // durable copy into RAM, to be lost at exit.
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-durable-"));
+    const file = path.join(dir, "client.json");
+    try {
+      await writeClientConfigStore(
+        file,
+        {
+          enterpriseManagedAuth: {
+            enabled: true,
+            idp: {
+              issuer: "https://idp.example/",
+              clientId: "cid",
+              clientSecret: "must-survive",
+            },
+          },
+        },
+        new SessionSecretStore(),
+      );
+      expect(await fs.readFile(file, "utf-8")).toContain("must-survive");
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("still strips against a durable store, so the guard is the difference", async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-durable-"));
+    const file = path.join(dir, "client.json");
+    try {
+      await writeClientConfigStore(
+        file,
+        {
+          enterpriseManagedAuth: {
+            enabled: true,
+            idp: {
+              issuer: "https://idp.example/",
+              clientId: "cid",
+              clientSecret: "goes-to-the-store",
+            },
+          },
+        },
+        new InMemorySecretStore(),
+      );
+      expect(await fs.readFile(file, "utf-8")).not.toContain(
+        "goes-to-the-store",
+      );
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});