Keep a Photo's save path after its file leaves; refuse an empty download directory

A Photo now keeps the file its record was made from (the record
projection holds one membership of each file), so savePath and isLocal
still answer after a refresh removes the file.

Library.open rejects an empty downloadDirectory.

A backup clears leftover temp files in every date folder under its
directory, not only in those of the files in its scope.

placeOriginal no longer deletes what is at the save path before copying
a live photo, and the tests that depended on that are removed.

The TODO.md entry for issue 143 describes only the current layout.

Model: opus-5-5

TODO.md

@@ -34,7 +34,7 @@ declares one.
   `photo.download()` puts the original there, copied from the cache when the
   cache holds it and fetched otherwise. `lib.backup()` does the same for each
   file, writes each file's JSON beside its original, and links `collections/` to
-  the save paths; the backup has no `originals/` folder.
+  the save paths.
 
 - 2026-10-01: `photo.exif()` and `backup-metadata --exif` read EXIF from
   HEIC/HEIF originals, a live photo's HEIC image included, as well as JPEG and