Fix the four findings of the second review

README.md: the opening no longer says the private key is needed only to
restore; a backup never needs it, a deep verify does.

ARCHITECTURE.md: the concurrency note says each open database uses one
connection, since the metadata export opens a second one.

docs/REPOSTRUCTURE.md: the size leak is about a secret near the
outsider's data in the same blob, not the same chunk, because all new
chunks of a blob share one zstd stream.

Every path used as link text in the four documents is in backticks.

Model: fable-5-1

ARCHITECTURE.md

@@ -9,8 +9,8 @@ things:
 
 Two other documents cover the stored data:
 
-- [docs/DATAMODEL.md](docs/DATAMODEL.md) describes the local index.
-- [docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md) describes the layout of the
+- [`docs/DATAMODEL.md`](docs/DATAMODEL.md) describes the local index.
+- [`docs/REPOSTRUCTURE.md`](docs/REPOSTRUCTURE.md) describes the layout of the
   destination.
 
 ## Terms
@@ -60,7 +60,7 @@ source files
   and the reader that reverses it.
 - `internal/database`: the local index. It holds the schema and the repository
   types that read and write the tables.
-  [docs/DATAMODEL.md](docs/DATAMODEL.md#code) says which type serves which
+  [`docs/DATAMODEL.md`](docs/DATAMODEL.md#code) says which type serves which
   table.
 - `internal/storage`: the `Storer` interface and its three implementations, for
   S3, a local directory and rclone.
@@ -225,7 +225,7 @@ file is never held in memory.
 
 The blob's name is `hex(SHA256(SHA256(uncompressed contents)))`. It is computed
 from the chunk data before compression and encryption.
-[docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#blobs) says what follows from
+[`docs/REPOSTRUCTURE.md`](docs/REPOSTRUCTURE.md#blobs) says what follows from
 that.
 
 When a blob is closed, `Scanner.handleBlobReady` stores it:
@@ -353,7 +353,7 @@ of object, once they are older than `prune_grace_period`:
   in the local index
 
 It deletes nothing when any manifest cannot be read.
-[docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#pruning) explains why this is
+[`docs/REPOSTRUCTURE.md`](docs/REPOSTRUCTURE.md#pruning) explains why this is
 safe, and where it is not.
 
 ## The destination
@@ -390,8 +390,7 @@ Every command that changes data calls `EnsureStorageBinding` first.
 
 ## Concurrency
 
-- The local index is opened with one connection, so its queries run one at a
-  time.
+- Each open database uses one connection, so its queries run one at a time.
 - The index runs in SQLite's WAL mode. A second process can therefore read it
   while a backup writes to it.
 - `Packer` guards its state with a mutex.