Master key provider backed by a file on disk.

Defaults to ~/.lemon/secrets_master_key; configure another location with config :lemon_core, LemonCore.Secrets, key_file: "/etc/lemon/master_key" or the :key_file option.

This is the provisioning target on platforms without a system keychain: the key file is created with 0600 permissions inside a 0700 directory, and the mode is applied before any key material is written.

A key file that is already readable beyond its owner — provisioned by hand, or restored from a backup that lost its mode — is warned about once per path and then used. Refusing it would lock you out of your own secrets over something chmod 600 fixes, and put/2 will not overwrite an existing key. Pass check_permissions: false to silence the check.