Move storage from SCRIPT_DIR to ~/.tmx-cli/ (security + correctness)

[TheTrustedAdvisor]

Problem

Sensitive files (cookies, search tokens) are stored in SCRIPT_DIR — the directory containing the script itself:

SCRIPT_DIR = Path(__file__).parent
COOKIES_FILE = SCRIPT_DIR / "cookidoo_cookies.json"       # Session cookies!
SEARCH_TOKEN_FILE = SCRIPT_DIR / "cookidoo_search_token.json"  # API token!
WEEKPLAN_JSON = SCRIPT_DIR / "cookidoo_weekplan_raw.json"
CATEGORIES_CACHE_FILE = SCRIPT_DIR / "cookidoo_categories.json"

Meanwhile, config lives separately in ~/.tmx_config.json, and the README (line 347) documents ~/.tmx-cli/ as the storage location — but the code doesn't use that path.

Issues

1. Security: Cookies (which grant full account access) are stored alongside code with default permissions (0o644). If the repo directory is shared or accidentally pushed, credentials leak.
2. Installed packages: When installed via pip/uvx, SCRIPT_DIR is inside site-packages — often read-only. Writing cookies there will fail.
3. Inconsistency: Config in $HOME, data in SCRIPT_DIR — split-brain storage.
4. Documentation mismatch: README says ~/.tmx-cli/, code uses SCRIPT_DIR.

Proposed Solution

Consolidate all storage under ~/.tmx-cli/:

DATA_DIR = Path.home() / ".tmx-cli"
DATA_DIR.mkdir(parents=True, exist_ok=True)

COOKIES_FILE = DATA_DIR / "cookidoo_cookies.json"
SEARCH_TOKEN_FILE = DATA_DIR / "cookidoo_search_token.json"
WEEKPLAN_JSON = DATA_DIR / "cookidoo_weekplan_raw.json"
CATEGORIES_CACHE_FILE = DATA_DIR / "cookidoo_categories.json"
CONFIG_FILE = DATA_DIR / "config.json"  # was ~/.tmx_config.json

Additionally, set file permissions to 0o600 for files containing secrets:

fd = os.open(str(COOKIES_FILE), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
with os.fdopen(fd, "w", encoding="utf-8") as f:
    json.dump(cookies_list, f, ensure_ascii=False, indent=2)

Migration

On first run, if old files exist in SCRIPT_DIR, move them to ~/.tmx-cli/ and print a notice.

Impact

• Security severity: HIGH
• Effort: Low-Medium (path changes + migration logic)