Bring README and TODO.md in line with the tree on next2 (closes #111)

The README layout lists src/library/ and the other source files, the
backup layout names failures.json and the optional thumbnails/, "Opening
a library" says an empty cache opens with no data when the first refresh
fails, and the Testing section gives the 60-second hard cap and 20-second
target for make test, with the 90-second timeout in the Dockerfile's test
phase as the backstop that catches a hung test. The next step in both
files is storing live photos
(#107) instead of a v1.0.0 tag;
tagging and releases are sneak's call alone.

Model: opus-5-5

TODO.md

@@ -23,13 +23,6 @@ declares one.
 
 # Completed Steps
 
-- 2026-09-23: Settled the package metadata (issue 6). quak is not published, so
-  `package.json` is marked `"private": true` and the `files` field is gone.
-  `engines.node` is `>=22`, the major version `script/bootstrap` and the
-  `Dockerfile` use. An `exports` map makes `.` and `./package.json` the only
-  importable paths; `runMetadataBackup`, the thumbnail helpers and their types
-  stay internal to the CLI.
-
 - 2026-09-23: Brought the README and this file in line with the tree (issue
   111). The layout lists `src/library/` and the other source files, the backup
   layout names `failures.json` and the optional `thumbnails/`, "Opening a

package.json

@@ -9,23 +9,17 @@
         "type": "git",
         "url": "https://git.eeqj.de/sneak/quak.git"
     },
-    "private": true,
     "type": "module",
-    "engines": {
-        "node": ">=22"
-    },
     "main": "./dist/src/index.js",
     "types": "./dist/src/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/src/index.d.ts",
-            "import": "./dist/src/index.js"
-        },
-        "./package.json": "./package.json"
-    },
     "bin": {
         "quak": "./dist/bin/quak.js"
     },
+    "files": [
+        "dist/",
+        "README.md",
+        "LICENSE"
+    ],
     "scripts": {
         "build": "script/build",
         "quak": "node ./dist/bin/quak.js",