fix: harden pi maintenance lifecycle

backend/src/settings/settings-store.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import type { AppConfig } from "../config.js";
 
@@ -29,6 +29,21 @@ export function loadSettings(cfg: AppConfig): Settings {
 /** Persist settings (pretty JSON). Creates the parent directory if needed. */
 export function saveSettings(cfg: AppConfig, s: Settings): Settings {
   mkdirSync(dirname(cfg.settingsFile), { recursive: true });
-  writeFileSync(cfg.settingsFile, JSON.stringify(s, null, 2) + "\n", "utf8");
+  const directory = dirname(cfg.settingsFile);
+  const temporary = `${cfg.settingsFile}.tmp-${process.pid}-${Date.now()}`;
+  const fd = openSync(temporary, "wx", 0o600);
+  try {
+    writeFileSync(fd, JSON.stringify(s, null, 2) + "\n", "utf8");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(temporary, cfg.settingsFile);
+  // The core image runs Linux. Keep the directory acknowledgement explicit there; Windows
+  // filesystem replacement semantics are delegated to the host-side Go durable writer.
+  if (process.platform !== "win32") {
+    const dirFd = openSync(directory, "r");
+    try { fsyncSync(dirFd); } finally { closeSync(dirFd); }
+  }
   return s;
 }