Bring README and TODO.md in line with the tree on next2 (closes #111)

The README layout lists src/library/ and the other source files, the
backup layout names failures.json and the optional thumbnails/, "Opening
a library" says an empty cache opens with no data when the first refresh
fails, and the Testing section gives the 60-second hard cap and 20-second
target for make test, with the 90-second timeout in the Dockerfile's test
phase as the backstop that catches a hung test. The next step in both
files is storing live photos
(#107) instead of a v1.0.0 tag;
tagging and releases are sneak's call alone.

Model: opus-5-5

README.md

@@ -799,9 +799,11 @@ documents:
 - **Formatting:** prettier with 4-space indents and `proseWrap: always` for
   markdown. Use `make fmt` to format. Use `yarn` not `npm`.
 
-- **Testing:** vitest. Tests go in `test/` mirroring the `src/` structure. The
+- **Testing:** vitest. Tests go in `test/` mirroring the `src/` structure.
-  `test` phase of the `Dockerfile` stops the suite after 90 seconds. Use
+  `make test` must finish in under 60 seconds (the hard cap) and should finish
-  `mkdtempSync` for temporary directories, never manual timestamp paths.
+  in under 20. The 90-second `timeout` in the `test` phase of the `Dockerfile`
+  is a backstop that catches a hung test, not the time limit. Use `mkdtempSync`
+  for temporary directories, never manual timestamp paths.
 
 - **Code style:** `const` for everything, `let` if reassignment is needed, never
   `var`. Avoid unnecessary comments. No hand-rolled crypto. The

TODO.md

@@ -26,9 +26,10 @@ declares one.
 - 2026-09-23: Brought the README and this file in line with the tree (issue
   111). The layout lists `src/library/` and the other source files, the backup
   layout names `failures.json` and the optional `thumbnails/`, "Opening a
-  library" says what happens when the first refresh fails, the test time limit
+  library" says what happens when the first refresh fails, the Testing section
-  is the 90 seconds the `Dockerfile` sets, and "Tag v1.0.0" is no longer listed
+  gives the 60-second hard cap and 20-second target for `make test` and names
-  as the next step.
+  the 90-second `timeout` in the `Dockerfile` as the backstop for a hung test,
+  and "Tag v1.0.0" is no longer listed as the next step.
 
 - 2026-09-23: Tested `quak login` and `backup-metadata --exif` (issue 110).
   `loginCommand` takes its login function and its prompts from `CliContext`, and