Bring README and TODO.md up to date with the code (closes #72)

README "HTTP Endpoints" lists every route setupRoutes registers with what
it answers, and "Database Schema" matches schema.sql. Other sentences the
code contradicts are corrected: the handlers' batch sizes, the stream
client, the macOS state directory, the build command and what
script/precommit checks; "Code Structure" gains the version and whois
packages.

TODO.md gets one line for each issue landed on next since 2026-10-03, and
a current Status, Next Step and Future Steps.

Model: opus-5-5

README.md

@@ -65,9 +65,8 @@ DEBUG=routewatch ./routewatch
   (`netblock`), that route's origin AS with its WHOIS details, and the address's
   PTR names. `{ip}` is an IP address, a host name (each address it resolves to
   is looked up), or a comma-separated list of these. `results` has one entry per
-  address with a live route and `errors` one per address or name that failed.
-  The answer is 400 when nothing in `{ip}` is an IP address or a host name that
-  resolves, and 404 when none of the addresses has a live route.
+  address found and `errors` one per address or name that failed; the answer is
+  404 when no address was found.
 - `GET /api/v1/as/{asn}` - The AS and the prefixes it originates, IPv4 and IPv6
   apart, each with when its newest route was updated
 - `GET /api/v1/prefix/{prefix}/{length}` - Every live route for the prefix, one
@@ -76,15 +75,7 @@ DEBUG=routewatch ./routewatch
 A JSON answer is `{"status": "ok", "data": ...}`, or for an error
 `{"status": "error", "error": {"msg": ..., "code": ...}}`, and carries an
 `@meta` object with the time zone, the API version and the time the request
-took. The health check is the exception: its 503 answer is also
-`{"status": "ok", "data": ...}`, with `error` in `data.status`.
-
-A request that runs past its time limit answers 504: the limit is 30 seconds,
-and 4 seconds for the database reads behind `/status.json` and `/api/v1/stats`.
-An AS number, prefix or mask length that does not parse answers 400, as does a
-mask length out of range for its IP version. An AS the database does not hold,
-or a prefix with no live route, answers 404. The HTML pages give these errors as
-plain text.
+took.
 
 An origin AS of 0 (`origin_asn` in a route, `asn` in an IP lookup, the key `0`
 in a prefix's `origins`) means the route has no known origin: its AS path ends

TODO.md

@@ -25,11 +25,8 @@ are measured by a benchmark, not yet on the live feed.
 
 # Next Step
 
-Run `next` on the live feed, as README "Running under upaas" describes, for the
-final check https://git.eeqj.de/sneak/routewatch/issues/96 names: whether the
-prefix handler still drops updates after the first hour. If it does, a new issue
-follows with the numbers. Then an audit of the code at the commit that run
-tested.
+`next` waits for sneak to merge it to `main` through
+https://git.eeqj.de/sneak/routewatch/pulls/87.
 
 # Completed Steps