Restrict file permissions for sensitive health data

Tighten file permissions on output files and geocoding cache to prevent
world-readable access to sensitive health information:

- Output directory: 0755 → 0700 (owner-only access)
- Output HTML files: implicit → 0600 (owner-only read/write)
- Geocoding cache directory: 0755 → 0700 (owner-only access)
- Geocoding cache file: 0644 → 0600 (owner-only read/write)

These changes ensure that HTML dashboards containing medical records and
cached geocoded facility addresses are only accessible by the file owner.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: jcrussell

pkg/cmd/generate/generate.go

@@ -149,7 +149,7 @@ func runGenerate(opts *GenerateOptions) error {
 	}
 
 	// 4. Generate Output
-	if err := os.MkdirAll(opts.OutputDir, 0755); err != nil {
+	if err := os.MkdirAll(opts.OutputDir, 0700); err != nil {
 		return err
 	}
 
@@ -206,7 +206,12 @@ func runGenerate(opts *GenerateOptions) error {
 
 		// Wrap in closure to ensure proper defer scoping in loop
 		if err := func() error {
-			f, err := os.Create(filepath.Join(opts.OutputDir, filename))
+			// Create HTML file with owner-only permissions (sensitive health data)
+			f, err := os.OpenFile(
+				filepath.Join(opts.OutputDir, filename),
+				os.O_WRONLY|os.O_CREATE|os.O_TRUNC,
+				0600,
+			)
 			if err != nil {
 				return err
 			}

pkg/geocode/geocode.go

@@ -186,7 +186,7 @@ func (g *NominatimGeocoder) SaveCache() error {
 
 	// Ensure cache directory exists
 	cacheDir := filepath.Dir(g.cachePath)
-	if err := os.MkdirAll(cacheDir, 0755); err != nil {
+	if err := os.MkdirAll(cacheDir, 0700); err != nil {
 		return fmt.Errorf("failed to create cache directory: %w", err)
 	}
 
@@ -220,7 +220,7 @@ func (g *NominatimGeocoder) SaveCache() error {
 
 	// Atomic write: write to temp file, then rename
 	tempPath := g.cachePath + ".tmp"
-	if err := os.WriteFile(tempPath, data, 0644); err != nil {
+	if err := os.WriteFile(tempPath, data, 0600); err != nil {
 		return fmt.Errorf("failed to write temp cache file: %w", err)
 	}