Make backup wait for the server refresh and fail when it fails (closes #99)

lib.backup() refreshed through the background loop's refresh, which returns
at once when one is already running and swallows a failure, so a backup
could run on the previous file list, or on an empty cache, and exit 0. It
now uses the refresh fresh() uses: it joins a running refresh or starts
one, and rejects before touching any file when it fails. The CLI's error
wrapper prints that as one line and exits 1.

Model: opus-5-5

src/backup.ts

@@ -1,9 +1,10 @@
 // The backup command, rebuilt on the library API (issue #51).
 //
-// `lib.backup()` refreshes the library, then, for every file in scope, gets its
-// original bytes onto disk under `downloadDirectory` and rebuilds the derived
-// views (per-file sidecars, per-collection symlink trees, per-collection JSON)
-// from the model. The on-disk layout is the historical one, unchanged:
+// `lib.backup()` waits for a completed refresh of the library (a failed one
+// fails the backup before any file is touched), then, for every file in scope,
+// gets its original bytes onto disk under `downloadDirectory` and rebuilds the
+// derived views (per-file sidecars, per-collection symlink trees,
+// per-collection JSON) from the model. The on-disk layout is the historical one, unchanged:
 //
 //     <downloadDirectory>/
 //         originals/<fileID>.<ext>     the decrypted bytes