Bring README and TODO.md in line with the tree on next2 (closes #111)

The README layout lists src/library/ and the other source files, the
backup layout names failures.json and the optional thumbnails/, "Opening
a library" says an empty cache opens with no data when the first refresh
fails, and the test time limit is the 90 seconds the Dockerfile sets.
The next step in both files is storing live photos (issue 107) instead
of a v1.0.0 tag; tagging and releases are sneak's call alone.

Model: opus-5-5

README.md

@@ -799,11 +799,9 @@ documents:
 - **Formatting:** prettier with 4-space indents and `proseWrap: always` for
   markdown. Use `make fmt` to format. Use `yarn` not `npm`.
 
-- **Testing:** vitest. Tests go in `test/` mirroring the `src/` structure.
-  `make test` must finish in under 60 seconds (the hard cap) and should finish
-  in under 20. The 90-second `timeout` in the `test` phase of the `Dockerfile`
-  is a backstop that catches a hung test, not the time limit. Use `mkdtempSync`
-  for temporary directories, never manual timestamp paths.
+- **Testing:** vitest. Tests go in `test/` mirroring the `src/` structure. The
+  `test` phase of the `Dockerfile` stops the suite after 90 seconds. Use
+  `mkdtempSync` for temporary directories, never manual timestamp paths.
 
 - **Code style:** `const` for everything, `let` if reassignment is needed, never
   `var`. Avoid unnecessary comments. No hand-rolled crypto. The

TODO.md

@@ -23,20 +23,12 @@ declares one.
 
 # Completed Steps
 
-- 2026-09-23: Settled the package metadata (issue 6). quak is not published, so
-  `package.json` is marked `"private": true` and the `files` field is gone.
-  `engines.node` is `>=22`, the major version `script/bootstrap` and the
-  `Dockerfile` use. An `exports` map makes `.` and `./package.json` the only
-  importable paths; `runMetadataBackup`, the thumbnail helpers and their types
-  stay internal to the CLI.
-
 - 2026-09-23: Brought the README and this file in line with the tree (issue
   111). The layout lists `src/library/` and the other source files, the backup
   layout names `failures.json` and the optional `thumbnails/`, "Opening a
-  library" says what happens when the first refresh fails, the Testing section
-  gives the 60-second hard cap and 20-second target for `make test` and names
-  the 90-second `timeout` in the `Dockerfile` as the backstop for a hung test,
-  and "Tag v1.0.0" is no longer listed as the next step.
+  library" says what happens when the first refresh fails, the test time limit
+  is the 90 seconds the `Dockerfile` sets, and "Tag v1.0.0" is no longer listed
+  as the next step.
 
 - 2026-09-23: Tested `quak login` and `backup-metadata --exif` (issue 110).
   `loginCommand` takes its login function and its prompts from `CliContext`, and

package.json

@@ -9,23 +9,17 @@
         "type": "git",
         "url": "https://git.eeqj.de/sneak/quak.git"
     },
-    "private": true,
     "type": "module",
-    "engines": {
-        "node": ">=22"
-    },
     "main": "./dist/src/index.js",
     "types": "./dist/src/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/src/index.d.ts",
-            "import": "./dist/src/index.js"
-        },
-        "./package.json": "./package.json"
-    },
     "bin": {
         "quak": "./dist/bin/quak.js"
     },
+    "files": [
+        "dist/",
+        "README.md",
+        "LICENSE"
+    ],
     "scripts": {
         "build": "script/build",
         "quak": "node ./dist/bin/quak.js",