Rebuild backup on the library API with a durable failure ledger (closes #51)

backup() is a Library method: it refreshes, fetches each pending original
(and optional thumbnails) through the content cache and pools, then rebuilds
the sidecar, symlink, and per-collection JSON views from the model. The
downloadDirectory layout and exit-code contract are unchanged.

An original already on disk is complete and never re-fetched, so runs are
idempotent and an interrupted run resumes. Per-file download and symlink
failures are recorded in a durable failures.json and no longer abort the run,
subsuming #8.

Each run reconciles the ledger against the files it attempted: an entry
survives only for a file that failed this run, so a failure for a
since-deleted or out-of-scope file clears instead of failing every future
scheduled backup.

Model: opus-4-8

bin/quak.ts

@@ -8,7 +8,7 @@ import { Command } from "commander";
 import envPaths from "env-paths";
 import { Client, type ClientSnapshot } from "../src/client.js";
 import { init } from "../src/crypto/index.js";
-import { runBackup } from "../src/backup.js";
+import { Library } from "../src/library/index.js";
 import { runMetadataBackup } from "../src/metadata-backup.js";
 import {
     listMissingThumbnails,
@@ -321,9 +321,14 @@ program
         const client = requireSession();
 
         stderr.write("Starting backup...\n");
-        const result = await runBackup(client, dir, (msg) => {
-            if (!opts.json) stderr.write(msg + "\n");
+        const lib = await Library.open({ client, downloadDirectory: dir });
+        const result = await lib.backup({
+            downloadDirectory: dir,
+            onProgress: (msg) => {
+                if (!opts.json) stderr.write(msg + "\n");
+            },
         });
+        lib.close();
 
         if (opts.json) {
             stdout.write(JSON.stringify(result, null, 2) + "\n");