Bring README and TODO.md up to date with the code (closes #72)

README "HTTP Endpoints" lists every route setupRoutes registers with what
it answers, including the error answers, and "Database Schema" matches
schema.sql. Other sentences the code contradicts are corrected: the
handlers' batch sizes, the stream client, the macOS state directory, the
build command and what script/precommit checks; "Code Structure" gains
the version and whois packages.

TODO.md gets one line for each issue landed on next since 2026-10-03, a
current Status and Future Steps, and a Next Step naming the run on the
live feed and the audit after it.

Model: opus-5-5

README.md

@@ -65,8 +65,9 @@ DEBUG=routewatch ./routewatch
   (`netblock`), that route's origin AS with its WHOIS details, and the address's
   PTR names. `{ip}` is an IP address, a host name (each address it resolves to
   is looked up), or a comma-separated list of these. `results` has one entry per
-  address found and `errors` one per address or name that failed; the answer is
-  404 when no address was found.
+  address with a live route and `errors` one per address or name that failed.
+  The answer is 400 when nothing in `{ip}` is an IP address or a host name that
+  resolves, and 404 when none of the addresses has a live route.
 - `GET /api/v1/as/{asn}` - The AS and the prefixes it originates, IPv4 and IPv6
   apart, each with when its newest route was updated
 - `GET /api/v1/prefix/{prefix}/{length}` - Every live route for the prefix, one
@@ -75,7 +76,15 @@ DEBUG=routewatch ./routewatch
 A JSON answer is `{"status": "ok", "data": ...}`, or for an error
 `{"status": "error", "error": {"msg": ..., "code": ...}}`, and carries an
 `@meta` object with the time zone, the API version and the time the request
-took.
+took. The health check is the exception: its 503 answer is also
+`{"status": "ok", "data": ...}`, with `error` in `data.status`.
+
+A request that runs past its time limit answers 504: the limit is 30 seconds,
+and 4 seconds for the database reads behind `/status.json` and `/api/v1/stats`.
+An AS number, prefix or mask length that does not parse answers 400, as does a
+mask length out of range for its IP version. An AS the database does not hold,
+or a prefix with no live route, answers 404. The HTML pages give these errors as
+plain text.
 
 An origin AS of 0 (`origin_asn` in a route, `asn` in an IP lookup, the key `0`
 in a prefix's `origins`) means the route has no known origin: its AS path ends

TODO.md

@@ -25,8 +25,11 @@ are measured by a benchmark, not yet on the live feed.
 
 # Next Step
 
-`next` waits for sneak to merge it to `main` through
-https://git.eeqj.de/sneak/routewatch/pulls/87.
+Run `next` on the live feed, as README "Running under upaas" describes, for the
+final check https://git.eeqj.de/sneak/routewatch/issues/96 names: whether the
+prefix handler still drops updates after the first hour. If it does, a new issue
+follows with the numbers. Then an audit of the code at the commit that run
+tested.
 
 # Completed Steps