test: cover state and audit contracts

[jamiesun]

Fixes #13.

Summary

• assert the settings directory is created with private 0700 permissions
• cover atomic settings-write cleanup when replacing settings.json fails
• add audit recorder field-contract coverage for host resolution, redaction, sudo, timeout, known_hosts and execution flags
• add table-driven audit effect coverage across ssh, password, host, and sftp modes

Why this closes #13

Together with #21 and #22, the listed security-sensitive focus areas now have targeted coverage: JSON contracts, timeout and exit-code behavior, command blocking, sudo stdin rewrite, settings atomic write/permissions, host-key behavior, and audit event contracts.

Coverage

• internal/app: 47.2% -> 48.6%

Verification

• go test ./internal/app -run 'TestSaveAndLoadSettings|TestSaveSettings_RenameFailureCleansTempFile|TestAuditRecorderRefreshRecordsExecutionContract|TestAuditEffectFlagsByModeAndAction'
• go test ./...
• go test -cover ./...
• git diff --check
• make check