fix: address Phase 4 review — cookie file permissions (0600), gitignore cookies dir

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -4,4 +4,5 @@ dist/
 *.db
 .env
 config.json
+cookies/
 .superpowers/

src/music/auth.ts

@@ -17,7 +17,7 @@ export function createCookieStore(cookieDir: string): CookieStore {
       fs.writeFileSync(
         filePath,
         JSON.stringify({ cookie, updatedAt: new Date().toISOString() }),
-        "utf-8"
+        { encoding: "utf-8", mode: 0o600 }
       );
     },