fix(cli): write lite up's Claude settings patch with secure_create

up() converted every other credential-bearing write (config.yaml,
autoroute's settings patch, the backup) to secure_create, but missed
its own CLAUDE_SETTINGS_PATH write, which still used plain open() and
could land at the umask-derived default (commonly 0644) instead of
0600.

litellm/proxy/client/cli/commands/up.py

@@ -221,7 +221,7 @@ def up(ctx: click.Context) -> None:
 
         CLAUDE_SETTINGS_PATH.parent.mkdir(exist_ok=True)
         merged = merge_claude_settings(original_settings, base_url, api_key_helper)
-        with open(CLAUDE_SETTINGS_PATH, "w") as f:
+        with secure_create(CLAUDE_SETTINGS_PATH) as f:
             json.dump(merged, f, indent=2)
     except (AgentRunError, UpError) as e:
         raise click.ClickException(str(e))

tests/test_litellm/proxy/client/cli/test_up_commands.py

@@ -324,6 +324,7 @@ class TestUpCommand:
         def fake_wait(self, timeout=None):
             captured["settings"] = json.loads(settings_path.read_text())
             captured["backup_existed"] = backup_path.exists()
+            captured["settings_mode"] = stat.S_IMODE(settings_path.stat().st_mode)
             return True
 
         with (
@@ -346,6 +347,7 @@ class TestUpCommand:
         assert captured["settings"]["theme"] == "dark"
         assert captured["settings"]["env"]["ANTHROPIC_BASE_URL"] == "http://localhost:4000"
         assert captured["settings"]["apiKeyHelper"] == "/usr/local/bin/lite auth print-token"
+        assert captured["settings_mode"] == 0o600
         assert json.loads(settings_path.read_text()) == original
         assert not backup_path.exists()