Harden token storage and declare Bun runtime

Enforce 0600 permissions after every auth token write so existing files
with broader modes are corrected.

Add a regression test for the permission hardening path and document the
Bun runtime dependency used by the Node/jiti search subprocess path.
Also declare bun in package dependencies and engines.

package.json

@@ -11,6 +11,9 @@
     "@mariozechner/pi-ai": "*",
     "@sinclair/typebox": "*"
   },
+  "dependencies": {
+    "bun": "^1.3.9"
+  },
   "devDependencies": {
     "@mariozechner/pi-coding-agent": "*",
     "@mariozechner/pi-tui": "*",
@@ -22,5 +25,8 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "test": "bun test"
+  },
+  "engines": {
+    "bun": ">=1.3.9"
   }
 }