The /config-file endpoint writes submitted configuration text to a fixed, world-readable path in /tmp and never removes it.

Location
src/services/api/rest/routers.py:721-723

Problem
Submitted configuration text is written as root to the fixed path /tmp/config.file with umask 002 and never removed. A local user can also pre-create the path.

Impact
Any local user reads the submitted configuration (PSKs, hashes); with fs.protected_regular the endpoint fails permanently once the file is squatted.

Suggested fix
tempfile.NamedTemporaryFile with 0600 under a root-owned directory; unlink in finally.

Acceptance criteria
No file remains in /tmp after the request.

File is 0600 while it exists.