Names quak builds from server data fit in 255 bytes (closes #205)

The default names of `quak get`, `quak get-thumb`, `downloadFile` and `downloadThumbnail`, and the album folders of `backup-metadata`, could be over 255 bytes, which a file system refuses. `defaultFileName` and `shortenKeepingExtension` in `src/filename.ts` now cut such a name short, keeping its extension when it fits; a live photo's image and video get their own extension before the cut. A cut name never starts with a dot and is never a Windows device name. `--out` and `outPath` are kept as given. A `backup-metadata` folder keeps its `<id>-`. `safeExtension` gives `.bin` for an extension of more than 16 letters and digits, so a save path's name always fits.

Model: opus-5-5

TODO.md

@@ -17,15 +17,32 @@ pre-1.0
 
 # Next Step
 
-One bug is open: https://git.eeqj.de/sneak/quak/issues/205. The check of quak
-against a live Ente account, https://git.eeqj.de/sneak/quak/issues/187, needs an
-account only sneak has, so it waits on him.
+No bug is open. Two changes sneak asked for are open:
+https://git.eeqj.de/sneak/quak/issues/211 and
+https://git.eeqj.de/sneak/quak/issues/212. The check of quak against a live Ente
+account, https://git.eeqj.de/sneak/quak/issues/187, needs an account only sneak
+has, so it waits on him.
 
 Tagging and releases are decided by sneak alone, and happen only when he
 declares one.
 
 # Completed Steps
 
+- 2026-10-18: Names quak builds from an album name or a title fit in a file name
+  (https://git.eeqj.de/sneak/quak/issues/205). `shortenKeepingExtension` in
+  `src/filename.ts` cuts a name short to a number of bytes, keeping its
+  extension when it fits and always its first character, and can put text right
+  before the extension; the backup's `withID` uses it for an ID.
+  `defaultFileName` there gives the name a file is saved under when the caller
+  gives no path: a prefix such as `thumb_` and the title with unsafe characters
+  replaced, cut short with it to 255 bytes, and, for a live photo's image or
+  video, with that part's own extension before the cut. `quak get`,
+  `quak get-thumb`, `downloadFile` and `downloadThumbnail` use it without
+  `--out` or `outPath`. `backup-metadata` cuts an album's name short so that its
+  folder, `<id>-<name>`, fits in 255 bytes. `safeExtension` gives `.bin` for an
+  extension of more than 16 letters and digits, so a save path's name always
+  fits.
+
 - 2026-10-18: `quak collections` no longer waits for the files of every
   collection (issue 210). On an empty cache it opened its library with a refresh
   that fetched and decrypted the files of each collection in turn, printing