Bring README and TODO.md in line with the tree on next2 (closes #111)

The README layout lists src/library/ and the other source files, the
backup layout names failures.json and the optional thumbnails/, "Opening
a library" says an empty cache opens with no data when the first refresh
fails, and the Testing section gives the 60-second hard cap and 20-second
target for make test, with the 90-second timeout in the Dockerfile's test
phase as the backstop that catches a hung test. The next step in both
files is storing live photos
(#107) instead of a v1.0.0 tag;
tagging and releases are sneak's call alone.

Model: opus-5-5

TODO.md

@@ -14,10 +14,23 @@ pre-1.0
 
 # Next Step
 
-Tag v1.0.0.
+Store live photos in a form a photo viewer can open
+(https://git.eeqj.de/sneak/quak/issues/107). This waits on sneak's choice
+between keeping the ZIP and unpacking it into the image and the video.
+
+Tagging and releases are decided by sneak alone, and happen only when he
+declares one.
 
 # Completed Steps
 
+- 2026-09-23: Brought the README and this file in line with the tree (issue
+  111). The layout lists `src/library/` and the other source files, the backup
+  layout names `failures.json` and the optional `thumbnails/`, "Opening a
+  library" says what happens when the first refresh fails, the Testing section
+  gives the 60-second hard cap and 20-second target for `make test` and names
+  the 90-second `timeout` in the `Dockerfile` as the backstop for a hung test,
+  and "Tag v1.0.0" is no longer listed as the next step.
+
 - 2026-09-23: Tested `quak login` and `backup-metadata --exif` (issue 110).
   `loginCommand` takes its login function and its prompts from `CliContext`, and
   `bin/quak.ts` passes `Client.login` and the terminal prompts. Tests cover a