fix(nodetoken): stop refusing every node-token key file on Windows

FileKeySource rejected any key file whose mode had group or other bits,
but Windows has no such bits: Stat reports every writable file as 0666.
On the Windows builds release.yml ships, the key file therefore never
loaded, not even one written 0600, and only XUI_NODE_TOKEN_KEY could
supply a key. The mode check now applies off Windows only, the stance
the DB permission tests already take; there the file's NTFS ACL guards
it, and env-vars.mdx says so in all four locales.

The load test is split so the half that must hold everywhere, an
owner-only file loading, also runs on Windows, and the rejection half
asserts the exact error instead of any error.

internal/crypto/nodetoken/keysource.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"runtime"
 	"strings"
 )
 
@@ -76,7 +77,8 @@ func decodeKey(b64 string) ([keyLen]byte, error) {
 	return out, nil
 }
 
-// FileKeySource accepts only key files that are mode 0600 or stricter.
+// FileKeySource accepts only key files that are mode 0600 or stricter. Windows has
+// no such bits (Stat reports 0666), so there the file's NTFS ACL is what guards it.
 type FileKeySource struct {
 	Path string
 }
@@ -86,7 +88,7 @@ func (f FileKeySource) Load() (*Keyring, error) {
 	if err != nil {
 		return nil, fmt.Errorf("nodetoken: stat key file %s: %w", f.Path, err)
 	}
-	if perm := info.Mode().Perm(); perm&0o077 != 0 {
+	if perm := info.Mode().Perm(); runtime.GOOS != "windows" && perm&0o077 != 0 {
 		return nil, fmt.Errorf("nodetoken: key file %s has insecure mode %#o (want 0600)", f.Path, perm)
 	}
 	data, err := os.ReadFile(f.Path)