feat: add secure Pi-hole DNS management

cmd/dyndns-web/main.go

@@ -32,6 +32,8 @@ func main() {
 }
 
 func run(logger *slog.Logger) error {
+	// Credentials and session data must never inherit a permissive process umask.
+	syscall.Umask(0o077)
 	cfg, err := config.Load()
 	if err != nil {
 		return err