Rewrite README.md sentence by sentence (closes #327)

Rewrites README.md from scratch against the code on next, for
#327: what pixa is and how to
use it, deployment, design, the settings reference, then development
and testing. The Configuration list keeps one item per setting, as
TestReadmeNamesEverySetting reads it; the test is unchanged. The
statements where the old text disagreed with the code are listed in
the PR body.

Model: fable-5-1 (writing), opus-5-5 (rework checks and commit)

README.md

@@ -106,9 +106,9 @@ pixa does the rest itself:
 The state directory (`state_dir`, `/var/lib/pixa` in the container) holds the
 database and the disk cache:
 
-- It needs a persistent volume. Without one, every restart starts with an empty
-  cache. Losing the directory also ends every login session (see Encrypted
-  URLs).
+- It needs a persistent volume. Without one, each new container starts with an
+  empty cache, as after every redeploy. Losing the directory also ends every
+  login session (see Encrypted URLs).
 - In the container, the startup script gives the directory to the user pixa runs
   as, uid 65532, and sets its mode to `750`. Outside the container, the user
   running pixa must be able to write it.
@@ -344,11 +344,10 @@ to any method the list does not give for it.
   Answers 401 without them. Answers 404 when they are not set, as the route then
   does not exist.
 
-A browser's CORS preflight request to any path under `/v1/` answers 200, in
-maintenance mode too. CORS is the browser rule that lets a page on one site read
-responses from another. The preflight is the `OPTIONS` request the browser sends
-first. It carries an `Origin` header and an `Access-Control-Request-Method`
-header.
+CORS is the browser rule that lets a page on one site read responses from
+another. The preflight is the `OPTIONS` request the browser sends first. It
+carries an `Origin` header and an `Access-Control-Request-Method` header. A
+preflight to any path under `/v1/` answers 200, in maintenance mode too.
 
 Every response carries an `X-Request-Id` header with the request's ID. A client
 can quote it when reporting a problem. A reverse proxy may send an
@@ -777,8 +776,9 @@ seconds for one. If none frees up, it is answered 503
 progress to all upstream hosts together, and `upstream_connections_per_host`
 those to one host. A fetch holds its connection until its image has been
 processed. A fetch that finds every shared connection in use waits up to 10
-seconds the same way, then answers 503. A fetch that finds every connection to
-its host in use waits for one until `downstream_timeout` ends.
+seconds for one. If none frees up, the request is answered 503
+`server busy, try again later`. A fetch that finds every connection to its host
+in use waits for one until `downstream_timeout` ends.
 
 **Client limits.** The login form (`POST /`) is limited to 5 attempts per minute
 per client address. An attempt over the limit is refused with 429 and a
@@ -1187,8 +1187,7 @@ are unchanged.
 The `test` phase runs on the Debian Go image, with Debian's libvips and libheif.
 The image pixa ships is built and runs on Alpine.
 
-These scripts are the standard copies from `sneak/prompts`, kept identical to
-them:
+These scripts are the standard copies from `sneak/prompts`:
 
 - `script/check`
 - `script/cibuild`
@@ -1199,7 +1198,8 @@ them:
 - `script/install-precommit`
 
 `script/fmt` and `script/fmt-check` are the standard copies with pixa's `gofmt`
-step kept before `prettier`. `prettier` formats the markdown only, not the HTML
+step kept before `prettier`. They also run `yarn` under the Node version that
+`script/bootstrap` pins. `prettier` formats the markdown only, not the HTML
 templates, as it cannot parse a Go template action inside a tag.
 
 ## Load Test
@@ -1260,8 +1260,8 @@ per second as `hits/s`. Each run starts with an empty cache and an empty
 database, a SQLite file of its own, and puts the image in the cache before it
 measures. The benchmark fails if serving the hits ran any statement on the
 database. Like the load test it is not part of `script/check`. It runs Go on the
-host, as the load test does, and compiles pixa there. So it needs the C compiler
-and libraries that `script/bootstrap --cgo` installs, but not Docker.
+host and compiles pixa there. So it needs the C compiler and libraries that
+`script/bootstrap --cgo` installs, but not Docker.
 
 ## TODO