Document every route, encrypted URLs and the config file search (closes #75)

README.md "Routes" lists every route pixa registers with its method,
purpose, what it needs and the status codes it answers with, read from
the handlers, and says q and fit are part of what is cached. A new
"Encrypted URLs" section covers logging in with the signing key, making
a URL on the generator page, how long it lasts, and the 410 once it has
expired. "Configuration" gives the order in which pixa looks for its
config file. config.example.yml now lists db_url and env and gives every
key's default. scripts/manual-test.sh is left to #97.

Model: opus-5-5

TODO.md

@@ -29,6 +29,14 @@ P2: security: referer blacklist
 
 # Completed Steps
 
+- 2026-10-04 routes, encrypted URLs and config file documented (closes #75):
+  "Routes" in `README.md` lists every route with its method, purpose, what it
+  needs and the status codes it answers with, and says `q` and `fit` are part
+  of what is cached; "Encrypted URLs" covers logging in, making one on the
+  generator page, how long it lasts and the 410 once it has expired;
+  "Configuration" gives the order in which pixa looks for its config file;
+  `config.example.yml` lists `db_url` and `env` and gives every key's default;
+  `scripts/manual-test.sh` is left to #97.
 - 2026-10-04 upstream host semaphores and variant `.meta` files no longer
   outlive their use (closes #87): the fetcher counts the fetches holding or
   waiting for a slot of each upstream host's semaphore and removes the host's
@@ -427,7 +435,5 @@ P2: security: referer blacklist
     - integration tests for the image proxy flow
     - load tests to verify the 1k to 5k req/s target
 - P2: documentation
-    - configuration options
-    - API endpoints
     - deployment guide
     - example nginx or caddy reverse proxy config