fix(store): mkdir cost-DB parent dir on OpenCostStore

mattn/go-sqlite3 surfaces a missing parent dir as the unhelpful
"unable to open database file: no such file or directory" error.
Production opens ctm.db at ~/.config/ctm/ctm.db — on a fresh install
or a CI runner with no pre-existing config dir, the parent doesn't
exist and OpenCostStore fails before doing anything useful.

Add a defensive os.MkdirAll(filepath.Dir(path), 0o700) at the top of
OpenCostStore. Skipped for the in-memory path (":memory:" → Dir
returns "." which is a no-op anyway, but explicit guard reads
better). Mkdir errors are swallowed — if mkdir fails we let
sql.Open surface the real problem instead of masking it.

Side benefit: server_test.go's TestHealthz* / TestAuth* etc. were
flakily passing or failing depending on whether earlier-running
test packages (alphabetical: internal/config, …) created
~/.config/ctm/ as a side effect. CI runs without a populated test
cache hit this regularly. Now they're independent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

internal/serve/store/cost_store.go

@@ -34,6 +34,8 @@ import (
 	"errors"
 	"fmt"
 	"net/url"
+	"os"
+	"path/filepath"
 	"sync"
 	"time"
 
@@ -92,6 +94,18 @@ type sqliteCostStore struct {
 // keeps the handler-side Writer from erroring under light contention
 // with the quota-subscriber goroutine.
 func OpenCostStore(path string) (CostStore, error) {
+	// Ensure the parent directory exists. Production opens the DB at
+	// ~/.config/ctm/ctm.db; on a fresh install (or in CI runners
+	// without a pre-existing config dir) the parent might not exist
+	// yet, and mattn/go-sqlite3 surfaces that as
+	// "unable to open database file". Cheap and idempotent — no-op
+	// for ":memory:" (filepath.Dir returns "."). Errors here are
+	// non-fatal: if mkdir fails we let sql.Open surface the real
+	// problem.
+	if path != ":memory:" {
+		_ = os.MkdirAll(filepath.Dir(path), 0o700)
+	}
+
 	// DSN tuning: ?_busy_timeout=5000 waits out brief writer locks;
 	// ?_journal=WAL enables concurrent readers; ?_sync=NORMAL pairs
 	// with WAL for an acceptable durability-vs-speed trade.