Security: Encrypt Google Drive token storage and lock down token file permissions

[techmore]

Title: Encrypt Google Drive token storage and lock down token file permissions
Type: security
Severity: high
Area: Google Drive integration / token persistence

Description:
Google Drive OAuth tokens are currently stored as plaintext JSON under data/google_drive_tokens.json. The current save path does not apply encryption or restrictive file permissions. On a shared machine or copied bundle/data directory, refresh tokens can be extracted and reused.

Evidence:

• nmapui/google_drive.py writes tokens with _save_json_file() and plain json.dumps(...)
• nmapui/paths.py defines GOOGLE_DRIVE_TOKEN_FILE = BASE_DIR / "data" / "google_drive_tokens.json"
• No chmod(0600) or platform keychain integration is applied during token writes

Proposed Fix:
Move token persistence to an encrypted secret store. On macOS, prefer Keychain-backed storage. If file storage remains as fallback, encrypt the payload and explicitly apply owner-only permissions.

Implementation Notes:

• Introduce a storage abstraction so auth/status/upload code stops assuming plaintext JSON
• Support migration from the existing plaintext token file
• Add tests for permission setting and migration behavior

Related Issues:

• Feature: Google Drive Upload Integration for Scan Reports #7
• Add Settings tab for scan rules, target profiles, and sync configuration #114

[techmore]

Implemented on codex/sqlite-lock-hardening.

Delivered:

• replaced plaintext Google Drive token persistence with encrypted-at-rest token storage in nmapui/google_drive.py
• added a dedicated token key file path in nmapui/paths.py
• applied owner-only file permissions to both token and key files
• added automatic migration from legacy plaintext token JSON to encrypted storage
• wired the key path through app-level Google Drive auth/upload flows in app.py
• added regression coverage for:
  • encrypted token writes
  • plaintext migration
  • token/key file permissions
  • token/key removal on disconnect

Verification:

• ./.venv/bin/python -m pytest -q
• 264 passed, 6 skipped

[techmore]

Closing as implemented on branch codex/sqlite-lock-hardening.