Harden token storage and declare Bun runtime

Enforce 0600 permissions after every auth token write so existing files
with broader modes are corrected.

Add a regression test for the permission hardening path and document the
Bun runtime dependency used by the Node/jiti search subprocess path.
Also declare bun in package dependencies and engines.

test/auth/storage.test.ts

@@ -0,0 +1,46 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+
+async function importStorageModule() {
+  return import(`../../src/auth/storage.ts?test=${crypto.randomUUID()}`);
+}
+
+afterEach(() => {
+  mock.restore();
+});
+
+describe("auth/storage", () => {
+  test("saveToken enforces 0600 permissions even when token file already exists", async () => {
+    const homeDir = await mkdtemp(join(tmpdir(), "pi-perplexity-storage-"));
+    const tokenPath = join(homeDir, ".config", "pi-perplexity", "auth.json");
+
+    try {
+      mock.module("node:os", () => ({
+        homedir: () => homeDir,
+      }));
+
+      await mkdir(dirname(tokenPath), { recursive: true });
+      await writeFile(tokenPath, '{"type":"oauth","access":"old"}\n', {
+        encoding: "utf8",
+        mode: 0o644,
+      });
+
+      const { saveToken } = await importStorageModule();
+      await saveToken({ type: "oauth", access: "new-token" });
+
+      const fileMode = (await stat(tokenPath)).mode & 0o777;
+      expect(fileMode).toBe(0o600);
+
+      const saved = JSON.parse(await readFile(tokenPath, "utf8")) as {
+        type: string;
+        access: string;
+      };
+      expect(saved.type).toBe("oauth");
+      expect(saved.access).toBe("new-token");
+    } finally {
+      await rm(homeDir, { recursive: true, force: true });
+    }
+  });
+});