Bring README and TODO.md in line with next after the milestone merge (closes #132)

Docs only. TODO.md's Next Step says no implementation work is open and
the cache design waits on sneak's review. The README is corrected
wherever the code contradicts it: login's TOTP and email OTP steps and
the crypto done outside libsodium; which errors are retried and what
each backup does with a failed download; which metadata a backup's JSON
keeps; the session and logout behavior; the CLI's --exif, --json, ML
data and thumbnail-fixer details; the cache's default directory and
size limit; when refreshes run and what fresh() and lib.backup() wait
for; the Photo fields; test coverage; the Makefile shims; and the
408/429 retries.

Model: opus-5-5

README.md

@@ -8,11 +8,12 @@ and downloads individual images while decrypting them on the way to disk.
 quak also includes a resilient backup command that downloads every file in the
 account into a deduplicated local directory tree, skipping files that already
 exist on disk and continuing past individual download failures instead of
-crashing. It decrypts and persists all three metadata layers (basic, private
-magic, public magic) per file, including camera info, GPS coordinates, captions,
-and any face/keyword labels the Ente clients have added. A helper subcommand can
-detect and regenerate missing thumbnails, encrypting and uploading them back to
-the server.
+crashing. For each file it persists the basic metadata fields quak keeps (title,
+file type, creation and modification time, latitude, longitude, content hash),
+and the private and public magic metadata in full, including camera info, GPS
+coordinates, captions, and any face/keyword labels the Ente clients have added.
+A helper subcommand can detect and regenerate missing thumbnails, encrypting and
+uploading them back to the server.
 
 ## Getting Started
 
@@ -220,7 +221,7 @@ quak/
                         and search, request pools
         backup.ts       resilient full-account backup with dedup
         metadata-backup.ts
-                        backup-metadata: all decrypted metadata as JSON
+                        backup-metadata: the metadata quak keeps, as JSON
         mldata-fetch.ts fetch + decrypt per-file ML data
         filename.ts     safe file names from server metadata
         errors.ts       error types shared across layers
@@ -470,7 +471,7 @@ quak files --collection <id> [--json]                     list files in a collec
 quak get <fileID> [--out path] [--collection]             download and decrypt a file
 quak get-thumb <fileID> [--out] [--collection]            download and decrypt a thumbnail
 quak backup <dir> [--json]                                full incremental backup
-quak backup-metadata <dir> [--exif]                       dump all decrypted metadata as JSON
+quak backup-metadata <dir> [--exif]                       dump the metadata quak keeps as JSON
 quak helper list-missing-thumbnails [--json]              find files with missing thumbnails
 quak helper fix-missing-thumbnails [--file ids] [--json]  generate + upload missing thumbnails
 ```
@@ -522,7 +523,9 @@ the smallest does not.
     originals/
         <fileID>.<ext>          actual file content (one per unique file,
                                 two for a live photo: see below)
-        <fileID>.json           all decrypted metadata for that file
+        <fileID>.json           the file's basic metadata fields quak
+                                keeps, and its private and public magic
+                                metadata
         <fileID>.livephoto.json which of a live photo's two files is which
     collections/
         <name>/
@@ -611,8 +614,7 @@ The library's primary surface is the cache-backed `Library`; the lower-level
 `Client` sits underneath it and is covered by the Design sections above. The
 test suite is the canonical, executable documentation — `test/library/` and
 `test/client/usage.test.ts` walk most operations, `test/cli/backup.test.ts`
-walks `lib.backup()`, and `yarn test` verifies them. No test calls
-`getFileByID()`.
+walks `lib.backup()`, and `yarn test` verifies them.
 
 ### Opening a library
 

TODO.md

@@ -41,12 +41,14 @@ declares one.
   `logout` open no library; `--exif` records XMP and, for a JPEG, EXIF, and no
   IPTC; which commands take `--json`; a failed ML data request may not have been
   retried; the thumbnail fixer is not limited to baseline JPEG; `quak backup`
-  still fetches ML data; the default cache directory is the per-user one, not an
-  XDG path on macOS; pinned originals can exceed `cacheOriginalsMaxBytes`; which
-  tests cover which operations; a default read is only as current as the last
-  refresh whose requests all succeeded; `fresh()` and `lib.backup()` join a
-  refresh already running; a `Photo` has no `thumbnailPath` or `originalPath`;
-  and `408` and `429` are retried.
+  still fetches ML data; a backup's JSON holds the basic metadata fields quak
+  keeps and the private and public magic metadata, not every decrypted field;
+  the default cache directory is the per-user one, not an XDG path on macOS;
+  pinned originals can exceed `cacheOriginalsMaxBytes`; which tests cover which
+  operations; a default read is only as current as the last refresh whose
+  requests all succeeded; `fresh()` and `lib.backup()` join a refresh already
+  running; a `Photo` has no `thumbnailPath` or `originalPath`; and `408` and
+  `429` are retried.
 
 - 2026-09-28: Tested the live-photo writer's fsyncs (issue 130). A test checks
   that the image's and the video's temp files are fsynced before either is