Fix the four findings of the second review

README.md: the opening no longer says the private key is needed only to
restore; a backup never needs it, a deep verify does.

ARCHITECTURE.md: the concurrency note says each open database uses one
connection, since the metadata export opens a second one.

docs/REPOSTRUCTURE.md: the size leak is about a secret near the
outsider's data in the same blob, not the same chunk, because all new
chunks of a blob share one zstd stream.

Every path used as link text in the four documents is in backticks.

Model: fable-5-1

README.md

@@ -6,7 +6,7 @@ with a public key and uploads them to an S3-compatible object store, a local
 directory or an rclone remote.
 
 The machine being backed up holds only the public key. It cannot decrypt its own
-backups. You keep the private key somewhere else and need it only to restore.
+backups. You keep the private key somewhere else. A backup never needs it.
 
 ## Rationale
 
@@ -1167,7 +1167,7 @@ destination still learns these:
 The last point holds because a remote key is a plain hash of the snapshot ID,
 made without a secret.
 
-[docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md) describes the layout of the
+[`docs/REPOSTRUCTURE.md`](docs/REPOSTRUCTURE.md) describes the layout of the
 destination, what it protects and the risks it accepts.
 
 ## Limitations
@@ -1207,9 +1207,9 @@ is a trimmed, encrypted copy of the local index.
 
 These documents give the detail:
 
-- [ARCHITECTURE.md](ARCHITECTURE.md) describes how the code is organised.
-- [docs/DATAMODEL.md](docs/DATAMODEL.md) describes the local index.
-- [docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md) describes the layout of the
+- [`ARCHITECTURE.md`](ARCHITECTURE.md) describes how the code is organised.
+- [`docs/DATAMODEL.md`](docs/DATAMODEL.md) describes the local index.
+- [`docs/REPOSTRUCTURE.md`](docs/REPOSTRUCTURE.md) describes the layout of the
   destination.
 
 ## Development