Bring README and TODO.md in line with next after the milestone merge (closes #132)

Docs only. TODO.md's Next Step says no implementation work is open and
the cache design waits on sneak's review. The README is corrected
wherever the code contradicts it: login's TOTP and email OTP steps and
the crypto done outside libsodium; which errors are retried and what
each backup does with a failed download; which metadata a backup's JSON
keeps; the session and logout behavior; the CLI's --exif, --json, ML
data and thumbnail-fixer details; the cache's default directory and
size limit; when refreshes run and what fresh() and lib.backup() wait
for; the Photo fields; test coverage; the Makefile shims; and the
408/429 retries.

Model: opus-5-5

README.md

@@ -10,10 +10,9 @@ account into a deduplicated local directory tree, skipping files that already
 exist on disk and continuing past individual download failures instead of
 crashing. For each file it persists the basic metadata fields quak keeps (title,
 file type, creation and modification time, latitude, longitude, content hash),
-and the private and public magic metadata in full, including camera info, GPS
-coordinates, captions, and any face/keyword labels the Ente clients have added.
-A helper subcommand can detect and regenerate missing thumbnails, encrypting and
-uploading them back to the server.
+and the private and public magic metadata in full. A helper subcommand can
+detect and regenerate missing thumbnails, encrypting and uploading them back to
+the server.
 
 ## Getting Started
 

TODO.md

@@ -42,9 +42,10 @@ declares one.
   IPTC; which commands take `--json`; a failed ML data request may not have been
   retried; the thumbnail fixer is not limited to baseline JPEG; `quak backup`
   still fetches ML data; a backup's JSON holds the basic metadata fields quak
-  keeps and the private and public magic metadata, not every decrypted field;
-  the default cache directory is the per-user one, not an XDG path on macOS;
-  pinned originals can exceed `cacheOriginalsMaxBytes`; which tests cover which
+  keeps and the private and public magic metadata, not every decrypted field,
+  and the README no longer lists what the magic metadata holds; the default
+  cache directory is the per-user one, not an XDG path on macOS; pinned
+  originals can exceed `cacheOriginalsMaxBytes`; which tests cover which
   operations; a default read is only as current as the last refresh whose
   requests all succeeded; `fresh()` and `lib.backup()` join a refresh already
   running; a `Photo` has no `thumbnailPath` or `originalPath`; and `408` and