p2.1: honcho-embed, wayback http/204, memento, keys owner

Embed requests send dixie.embed_model (default honcho-embed).
Wayback accepts http://web.archive.org, rewrites to https, skips
non-200 closest.status. Memento-Datetime is parsed as an HTTP date
and future/garbage values become empty snapshot_at. keys add writes
via temp+fchown/chmod/rename so root does not clobber keys.toml.
Digest fallback is capped at the 6k-token budget.

internal/auth/auth.go

@@ -8,8 +8,10 @@ import (
 	"encoding/hex"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 	"sync"
+	"syscall"
 
 	"github.com/pelletier/go-toml/v2"
 )
@@ -112,11 +114,7 @@ func Add(path, name, workspace, keyOut string) error {
 	if err != nil {
 		return err
 	}
-	tmp := path + ".tmp"
-	if err := os.WriteFile(tmp, out, 0o640); err != nil {
-		return err
-	}
-	return os.Rename(tmp, path)
+	return writePreserving(path, out)
 }
 
 func List(path string) ([]Caller, error) {
@@ -151,5 +149,49 @@ func Revoke(path, name string) error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(path, raw, 0o640)
+	return writePreserving(path, raw)
+}
+
+func writePreserving(path string, data []byte) error {
+	mode := os.FileMode(0o640)
+	uid, gid := -1, -1
+	if st, err := os.Stat(path); err == nil {
+		mode = st.Mode()
+		if sys, ok := st.Sys().(*syscall.Stat_t); ok {
+			uid, gid = int(sys.Uid), int(sys.Gid)
+		}
+	}
+	f, err := os.CreateTemp(filepath.Dir(path), ".sift-keys-*.tmp")
+	if err != nil {
+		return err
+	}
+	tmp := f.Name()
+	ok := false
+	defer func() {
+		if !ok {
+			_ = os.Remove(tmp)
+		}
+	}()
+	if _, err := f.Write(data); err != nil {
+		_ = f.Close()
+		return err
+	}
+	if err := f.Chmod(mode.Perm()); err != nil {
+		_ = f.Close()
+		return err
+	}
+	if uid >= 0 {
+		if err := f.Chown(uid, gid); err != nil {
+			_ = f.Close()
+			return err
+		}
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		return err
+	}
+	ok = true
+	return nil
 }

internal/auth/auth_test.go

@@ -50,3 +50,22 @@ func TestAddLookupRevoke(t *testing.T) {
 		t.Fatal("revoked still valid")
 	}
 }
+
+func TestAddPreservesKeysMode(t *testing.T) {
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "keys.toml")
+	if err := os.WriteFile(keys, []byte(""), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	out := filepath.Join(dir, "k")
+	if err := Add(keys, "talos", "hermes-fleet", out); err != nil {
+		t.Fatal(err)
+	}
+	st, err := os.Stat(keys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Mode().Perm() != 0o600 {
+		t.Fatalf("mode %o", st.Mode().Perm())
+	}
+}