enhancement: auto-fix auth.toml permissions + create global config on first run

[ajianaz]

Description

Two UX friction points on fresh install:

1. auth.toml is created with 644 permissions — should be 600. A warning is shown but no auto-fix.
2. No ~/.cora/config.yaml is created on first run — defaults to OpenAI without telling the user.

Expected Behavior

1. After writing auth.toml, auto-chmod to 600
2. cora init or first cora review should create ~/.cora/config.yaml with sensible defaults
3. Show clear setup instructions if no provider is configured

Current Workaround

mkdir -p ~/.cora
chmod 600 ~/.cora/auth.toml
cat > ~/.cora/config.yaml << EOF
provider:
  provider: zai
  model: glm-5.1
  base_url: https://api.z.ai/api/coding/paas/v4
EOF

[ajianaz]

Partially fixed:\n\n1. ✅ auth.toml auto-fixes permissions to 600 — load_api_key_from_auth_file() auto-fixes on read (line 389-395 in loader.rs)\n2. ✅ save_provider_info() creates ~/.cora/config.yaml on cora auth login\n\nBoth UX friction points addressed by the config centralization work (PR #210, #211).