Consolidate docs: rewrite README as primary reference, remove TODO.md

README now covers: storage backends (s3/file/rclone), all CLI commands
with full flag docs, configuration reference table, architecture overview,
roadmap (post-1.0 only), and development workflow.

TODO.md removed — completed items dropped, remaining roadmap items
merged into README.

ARCHITECTURE.md updated: correct snapshot ID format, storage.Storer
instead of s3.Client, binary SQLite export instead of SQL dump.

TODO.md

@@ -1,44 +0,0 @@
-# Vaultik 1.0 TODO
-
-Remaining tasks before 1.0 release.
-
-## Must-fix
-
-1. Scanner uses bare `fmt.Printf` (bypasses `--cron` silence)
-   - Route all user-facing output through a writer gated by progress/cron flags
-   - Affects `internal/snapshot/scanner.go` (~24 bare print calls)
-
-1. S3 client error type checking
-   - `internal/s3/client.go:207` has a TODO for proper error type checking
-
-1. Error message polish
-   - Add actionable suggestions for common failures (missing config, bad
-     storage URL, failed S3 auth, missing age key on restore/verify)
-   - Only `restore.go` currently has the "did you set VAULTIK_AGE_SECRET_KEY?" hint
-
-## Done
-
-- [x] Rclone storage backend
-- [x] Release process (goreleaser, CGO-free cross-compile, checksums)
-- [x] End-to-end integration test (backup → restore → verify → byte-compare)
-- [x] Restore integration tests
-- [x] `--prune` flag on `snapshot create` (per-name retention + orphan blob cleanup)
-- [x] Per-name purge retention (`--keep-latest` per snapshot name, `--snapshot` filter)
-- [x] CLI surface dedup (removed top-level `purge` and `verify` duplicates)
-- [x] Exit codes (create/restore now exit non-zero on failure)
-- [x] Deep verify implemented and wired up
-- [x] Shallow verify timestamp parsing fixed
-- [x] Daemon mode removed
-- [x] Makefile targets separated (`lint`/`test`/`fmt`/`check`)
-- [x] CGO eliminated (pure-Go SQLite via modernc.org/sqlite)
-- [x] Version set correctly in releases via goreleaser ldflags
-
-## Post-1.0
-
-1. Edge-case tests (empty dirs, symlinks, special chars, multi-GB files, 100k+ small files)
-1. Error-condition tests (network failures, disk full, corrupted/missing blobs)
-1. Parallel blob downloads during restore
-1. Bandwidth limiting (`--bwlimit`)
-1. Security audit of encryption (verify no plaintext leaks, correct hash computation)
-1. Man pages / richer `--help` examples
-1. Tag and release v1.0.0