Rewrite the backup command on the library API with a durable failure ledger (closes #51)

Rewrites backup on the library API. backup() refreshes, fetches pending originals (and optionally thumbnails) through the pools reusing the content cache, then materialises the unchanged collections/ symlink views + per-collection JSON + sidecars from the model. A symlink failure no longer aborts the run (closes #8). failures.json reconciles against each run's attempted set — since-deleted/out-of-scope/resolved entries clear, still-failing retained, one attempt per file per run — and the exit-code contract is preserved.

Model: opus-4-8

src/library/index.ts

@@ -74,6 +74,14 @@ export {
 import type { CollectionsPage, FilesPage } from "../client.js";
 import { MLDATA_BATCH_SIZE, type MLData } from "../mldata-fetch.js";
 import type { Collection, EnteFile } from "../model/types.js";
+import { runBackup, type BackupOptions, type BackupResult } from "../backup.js";
+
+export {
+    runBackup,
+    type BackupOptions,
+    type BackupResult,
+    type BackupError,
+} from "../backup.js";
 
 export const DEFAULT_REFRESH_INTERVAL_SECONDS = 3;
 
@@ -396,6 +404,45 @@ export class Library {
         };
     }
 
+    // Back up every in-scope file to `downloadDirectory` in the historical
+    // on-disk layout, with a durable failure ledger (issue #51). Refreshes
+    // first, fetches pending originals (and optional thumbnails) through the
+    // content cache and pools, then rebuilds the derived symlink/JSON views
+    // from the model. Throws before any network work when no download directory
+    // is available or no content cache backs the originals it must fetch.
+    backup(opts?: BackupOptions): Promise<BackupResult> {
+        const downloadDirectory =
+            opts?.downloadDirectory ?? this.downloadDirectory;
+        const includeOriginals = opts?.includeOriginals ?? true;
+        const includeThumbnails = opts?.includeThumbnails ?? false;
+        if (!downloadDirectory) {
+            return Promise.reject(
+                new Error(
+                    "backup requires a downloadDirectory (pass one to " +
+                        "backup() or open the library with one)",
+                ),
+            );
+        }
+        if ((includeOriginals || includeThumbnails) && !this.cache) {
+            return Promise.reject(
+                new Error(
+                    "backup requires a library opened with a content cache",
+                ),
+            );
+        }
+        const cache = this.cache;
+        return runBackup(
+            {
+                refresh: () => this.runRefresh(),
+                listCollections: () => this.store.listCollections(),
+                listFiles: (id) => this.store.listFiles(id),
+                original: (fileID) => cache!.original(fileID),
+                thumbnail: (fileID) => cache!.thumbnail(fileID),
+            },
+            { ...opts, downloadDirectory },
+        );
+    }
+
     // Stop the background timer. Idempotent. An in-flight refresh is left to
     // finish; it will not schedule another cycle once closed.
     close(): void {