fix(security): Telegram stderr log 0644→0600 — world-readable file in /tmp

spawnChild() opens /tmp/odek-telegram.log with 0644 permissions,
making the Telegram bot's stderr output readable by any user on the
system. This log contains startup errors, connection failures, and
other diagnostic output that could leak paths or sensitive context.

Changed to 0600 (owner-only read/write). The log is a private
debugging artifact for the process that created it.

Fixes H4 from security audit.

Author: molty3000

cmd/odek/telegram.go

@@ -881,7 +881,7 @@ func spawnChild() error {
 	argv[0] = exe
 
 	// Open stderr log file for the child so startup errors aren't lost.
-	stderr, err := os.OpenFile("/tmp/odek-telegram.log", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+	stderr, err := os.OpenFile("/tmp/odek-telegram.log", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
 	if err != nil {
 		stderr = nil // fallback: child gets /dev/null
 	}