Address review: safer save, stricter load and id parsing

- save() follows symlinks, keeps permissions, uses a unique temp file and cleans it up on failure
- load() rejects entries that aren't {id, text, done}
- add() finds the max id with reduce (no spread limit)
- CLI accepts only plain digits as ids and reports save errors readably
- Ignore *.tmp

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 todos.json
+*.tmp
 .DS_Store
 
 # Personal Claude Code overrides (not shared)