An expired session exits 3 with one line saying to run quak login (closes #164)

A 401 from the server reaches run in src/cli-run.ts as the ApiError the
refresh threw, so run recognises it there, prints one line saying to run
"quak login" and exits 3. A missing or corrupt session file keeps its message
and also exits 3. quak backup meets the 401 on its first refresh, before it
touches any file. Every other error still exits 1.

Judgement call: quak logout is unchanged; it handles its own errors and
deletes the session file whatever the server answers.
Judgement call: quak backup still prints its two progress lines before the
error line.

Model: opus-5-5

README.md

@@ -516,8 +516,14 @@ The CLI stores the snapshot at the platform-appropriate data directory via
 `0600`. The key material is stored in cleartext in the JSON; treat this file as
 you would treat the password itself. A missing file is reported as "not logged
 in"; a file that exists but is corrupt is reported as such, naming the bad
-field. Both exit with status 1, except that `quak logout` with no file says
-there is no session and exits 0.
+field. When the server answers a command's request with HTTP 401, because it no
+longer accepts the saved session's token, the command prints one line,
+`quak: the saved session is no longer valid; run "quak login"`, with no stack
+trace. All three exit with status 3, which means the user must run `quak login`
+again. `quak logout` is the exception: with no file it says there is no session
+and exits 0, and it handles a corrupt file or a failed server call as described
+below. `quak backup` meets an expired session on the refresh that starts every
+run, before it touches any file. No command but `quak login` ever prompts.
 
 `quak logout` ends the session on the server, so the token in `session.json`
 stops working even in a copy of the file, and then deletes the file. If the
@@ -551,8 +557,9 @@ library. The read commands — `collections`, `files`, `get`, `get-thumb`,
 `helper fix-missing-thumbnails` — force a fresh server round-trip before they
 answer, so they report current account state rather than whatever the cache last
 held. If that round-trip fails, the command prints the error on one line and
-exits 1. `--cache-dir` overrides where the cache lives; without it each account
-gets its own directory under the per-user cache path.
+exits 1, or 3 when the server no longer accepts the saved session (see "Session
+handling"). `--cache-dir` overrides where the cache lives; without it each
+account gets its own directory under the per-user cache path.
 
 `get` and `get-thumb` resolve the file by ID directly, so `--collection` is
 accepted for backward compatibility but ignored. For a live photo, `get` writes