feat(library/store): on-disk JSON metadata store for the local cache

Add `MetadataStore` (src/library/store.ts): one metadata.json holding the
user id, schema version, collections cursor, and decrypted collection and
file records. Loaded whole into RAM with Maps for id lookups; rewritten
whole through the download layer's fsync atomic writer (temp, fsync,
rename, dir fsync). Binary keys are base64-encoded on disk. A missing,
unparseable, or wrong-schema file loads as an empty store, because the
file is only a cache the refresh unit repopulates. Directory 0700, file
0600, matching session.json. No lock file; no sync() beyond the writer.

This unit only stores; issue 42's refresh unit populates it. (closes #41)

Model: opus-4-8

TODO.md

@@ -18,6 +18,13 @@ Update the README API reference section to match the current implementation.
 
 # Completed Steps
 
+- 2026-09-22: Added the on-disk JSON metadata store (`src/library/store.ts`,
+  issue 41), phase 2 of the cache/API work. One `metadata.json` holds the user
+  id, schema version, collections cursor, and the decrypted collection and file
+  records, loaded whole into RAM with `Map`s for id lookups and rewritten whole
+  through the download layer's fsync atomic writer. Missing, corrupt, or
+  wrong-schema files load empty; the directory is 0700 and the file 0600. The
+  store only stores — the refresh unit (issue 42) populates it.
 - 2026-09-22: Carried file size, thumbnail size, and the deletion flag through
   `decryptFile` (issue 37, foundation for the cache/API design). Live files now
   populate `file.size`/`thumbnail.size` from the server's `info` (left