Say what a backup needs on an rclone remote and fix four more findings

- `README.md`, `docs/REPOSTRUCTURE.md`, `internal/cli/snapshot.go`: a
  backup needs only write permission on S3; an rclone remote that can
  move objects also needs read and delete, and an upload there stops
  when its look-up is refused.
- `docs/DATAMODEL.md`, `docs/REPOSTRUCTURE.md`: a restore reads no
  file, chunk or blob rows from the local index, but it does open it.
- `README.md`: confirmation prompts go to stdout.
- `internal/cli/remote.go`: `remote nuke` leaves the backup destination
  store empty, not a bucket prefix.
- `README.md`: a TODO section, as `REPO_POLICIES.md` requires.

Model: fable-5-1

internal/cli/remote.go

@@ -42,8 +42,8 @@ func newRemoteNukeCommand() *cobra.Command {
 		Short: "Delete ALL snapshot metadata and blobs from the backup destination store",
 		Long: `Removes every snapshot's metadata, every blob and the destination
 marker from the backup destination store, and each removed snapshot from
-the local index. After this command completes successfully the bucket
-prefix is empty and the next backup starts from scratch.
+the local index. After this command completes successfully the backup
+destination store is empty and the next backup starts from scratch.
 
 This is destructive and irreversible. Requires --force, and permission
 to list and delete objects on the destination store.`,

internal/cli/snapshot.go

@@ -69,7 +69,8 @@ If no names are provided, all configured snapshots are created.
 Needs at least one public key in age_recipients, and permission to write
 objects at the backup destination store. It does not need the age private
 key. With --prune it also needs permission to list, read and delete objects
-there.
+there. An rclone remote that can move objects also needs permission to
+read and delete.
 
 The config is read from the path given by --config or VAULTIK_CONFIG;
 otherwise from the platform config directory (~/.config/vaultik/config.yml