pub fn write_api_token(paths: &BeamPaths, token: &str) -> Result<()>
Atomically write the token (tmp + rename) with 0600 permissions on Unix.