p2.1: honcho-embed, wayback http/204, memento, keys owner

Embed requests send dixie.embed_model (default honcho-embed).
Wayback accepts http://web.archive.org, rewrites to https, skips
non-200 closest.status. Memento-Datetime is parsed as an HTTP date
and future/garbage values become empty snapshot_at. keys add writes
via temp+fchown/chmod/rename so root does not clobber keys.toml.
Digest fallback is capped at the 6k-token budget.

internal/auth/auth_test.go

@@ -50,3 +50,22 @@ func TestAddLookupRevoke(t *testing.T) {
 		t.Fatal("revoked still valid")
 	}
 }
+
+func TestAddPreservesKeysMode(t *testing.T) {
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "keys.toml")
+	if err := os.WriteFile(keys, []byte(""), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	out := filepath.Join(dir, "k")
+	if err := Add(keys, "talos", "hermes-fleet", out); err != nil {
+		t.Fatal(err)
+	}
+	st, err := os.Stat(keys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Mode().Perm() != 0o600 {
+		t.Fatalf("mode %o", st.Mode().Perm())
+	}
+}