Format the rewritten documents with prettier

Re-wraps README.md, docs/ARCHITECTURE.md, docs/DATAMODEL.md,
docs/REPOSTRUCTURE.md and the roadmap in docs/TODO.md with `make fmt`,
which now runs prettier on Markdown. Only line wrapping changes; the
words are those that passed review at 4da102c.

Model: fable-5-1

docs/REPOSTRUCTURE.md

@@ -63,8 +63,8 @@ not exist, commands treat the destination as not present:
 - `snapshot list` shows the local index alone.
 - `snapshot remove` deletes nothing at the destination.
 
-The check is skipped when the look-up fails for any other reason. S3 refuses
-the look-up to credentials that can only write. A machine with such credentials
+The check is skipped when the look-up fails for any other reason. S3 refuses the
+look-up to credentials that can only write. A machine with such credentials
 therefore does not notice an emptied destination. Its next backup would not
 upload data that its local index says is stored. After a destination is emptied,
 run `vaultik database delete` on such a machine before it backs up again.
@@ -103,8 +103,8 @@ This has two consequences:
 
 ### Uploads
 
-A backup looks a blob up by name before it uploads it. It does not upload a
-blob that is already there.
+A backup looks a blob up by name before it uploads it. It does not upload a blob
+that is already there.
 
 On S3, when the destination refuses the look-up, the backup uploads the blob. An
 object with that name is then replaced by one that holds the same chunk data.
@@ -290,9 +290,9 @@ than four times this size. Only a file's last chunk can be smaller than a
 quarter of it. With the default of 10 MB, those limits are 40 MB and 2.5 MB. A
 file of 2.5 MB or less is one chunk. An empty file has no chunk.
 
-At the default `blob_size_limit` of 10 GB, a full blob holds hundreds of
-chunks. The size of the blob then does not show the size of any one chunk. A
-limit close to `chunk_size` begins to show chunk sizes.
+At the default `blob_size_limit` of 10 GB, a full blob holds hundreds of chunks.
+The size of the blob then does not show the size of any one chunk. A limit close
+to `chunk_size` begins to show chunk sizes.
 
 ### Decrypted data on the local disk
 
@@ -329,17 +329,17 @@ permission. Other commands need more:
     - `remote nuke`
 - `prune` lists, reads and deletes.
 
-An rclone remote that can move objects also needs permission to read and
-delete. An upload there looks up the object it replaces and deletes it. It stops
-when the look-up is refused.
+An rclone remote that can move objects also needs permission to read and delete.
+An upload there looks up the object it replaces and deletes it. It stops when
+the look-up is refused.
 
 `snapshot verify` and `snapshot restore` list only when they are given a remote
 key. `snapshot remove --local-only` does not reach the destination.
 `snapshot remove --dry-run` deletes nothing.
 
 `snapshot create --prune` runs a prune on the backed-up machine. That machine
-then holds credentials that can delete its own backups. To keep it to
-write-only credentials, run `prune` from a separate, trusted machine.
+then holds credentials that can delete its own backups. To keep it to write-only
+credentials, run `prune` from a separate, trusted machine.
 
 ### New recipients cannot read old data
 
@@ -374,18 +374,17 @@ manifest is written last. A directory under `metadata/` that has no manifest
 therefore belongs to a backup that did not finish.
 
 The local index marks a snapshot complete only after both metadata files are
-uploaded. A backup that stops during that upload leaves the snapshot
-unfinished. The next backup removes it from the local index and backs up its
-files again.
+uploaded. A backup that stops during that upload leaves the snapshot unfinished.
+The next backup removes it from the local index and backs up its files again.
 
 One short gap remains. A backup can stop after the upload and before the
 snapshot is marked complete. The destination then holds a snapshot that can be
 restored, and the local index marks it unfinished. `snapshot list` shows it as
 remote only.
 
-An upload that is cut off leaves no partial object under the final name on S3
-or on a local directory. The same holds for an rclone remote that can move
-objects. An rclone remote that cannot move objects can keep a partial object.
+An upload that is cut off leaves no partial object under the final name on S3 or
+on a local directory. The same holds for an rclone remote that can move objects.
+An rclone remote that cannot move objects can keep a partial object.
 
 ## Pruning
 
@@ -410,11 +409,11 @@ running. Such a backup has uploaded blobs and perhaps `db.zst.age`, but not yet
 its manifest. A prune from this machine or another keeps those objects, as long
 as no backup takes longer than the grace period.
 
-The grace period does not protect one case. A backup does not upload a blob
-that is already at the destination, so that blob keeps the time of its first
-upload. The blob can be left over from an earlier backup that stopped before
-its manifest. A prune that runs before the new manifest is written can then
-delete that blob. The new snapshot cannot be restored afterwards.
+The grace period does not protect one case. A backup does not upload a blob that
+is already at the destination, so that blob keeps the time of its first upload.
+The blob can be left over from an earlier backup that stopped before its
+manifest. A prune that runs before the new manifest is written can then delete
+that blob. The new snapshot cannot be restored afterwards.
 
 To avoid this case, give each machine and each user its own destination.
 
@@ -436,5 +435,4 @@ It works in these steps:
 - It downloads and decrypts the blobs it needs. It checks each blob against its
   name.
 - It writes each file from its chunks.
-- It sets each file's permissions and times, and its owner when it runs as
-  root.
+- It sets each file's permissions and times, and its owner when it runs as root.