An autosave taken mid-turn wrote a snapshot of a running turn, and the file
format had nothing to distinguish it from a finished one: on resume the last
assistant message was indistinguishable from half an answer. It is now marked,
the resume says so on screen and to the model, and a file written before the
marker still loads.

The write was already temp-plus-rename, but neither the file nor the folder was
synced, so a power loss right after the rename could leave the previous save in
place despite a successful write. Both are synced now. The session file and the
config were created world-readable while holding API keys; they are 0600.

A key pasted into a conversation was written verbatim into the session file,
which is the thing a user is most likely to paste into a bug report. It is
redacted at write time, leaving ordinary words that merely begin like a key
alone. `AppConfig::save()` also reported success when there was nowhere to
write; it returns the error now.

Measured: 997 tests across llm, core, svc, tools and the tui binary, and
scenarios end to end. Clippy clean across the workspace.