fix: use secure home directory path instead of /tmp for session persistence

Replace insecure /tmp/test-app-data fallback with ~/.aperant-test-data
to avoid CodeQL "insecure temporary file" alerts. Using /tmp is a
security risk because it's world-writable.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

apps/desktop/src/__mocks__/electron.ts

@@ -7,12 +7,14 @@ import { EventEmitter } from 'events';
 // Mock app
 export const app = {
   getPath: vi.fn((name: string) => {
+    const os = require('os');
+    const path = require('path');
     const paths: Record<string, string> = {
-      userData: '/tmp/test-app-data',
-      home: '/tmp/test-home',
-      temp: '/tmp'
+      userData: path.join(os.homedir(), '.aperant-test-data'),
+      home: os.homedir(),
+      temp: os.tmpdir()
     };
-    return paths[name] || '/tmp';
+    return paths[name] || path.join(os.homedir(), '.aperant-test');
   }),
   getAppPath: vi.fn(() => '/tmp/test-app'),
   getVersion: vi.fn(() => '0.1.0'),

apps/desktop/src/main/terminal/session-persistence.ts

@@ -23,8 +23,10 @@ function getUserDataPath(): string {
   } catch {
     // Ignore errors in test environment
   }
-  // Fallback for test environment
-  return '/tmp/test-app-data';
+  // Fallback for test environment - use home directory instead of /tmp for security
+  const os = require('os');
+  const path = require('path');
+  return path.join(os.homedir(), '.aperant-test-data');
 }
 
 const SESSIONS_FILE = path.join(getUserDataPath(), 'terminal-sessions.json');