Delete metadata directories a backup left without a manifest (closes #390)

A backup that stopped between uploading db.zst.age and its manifest
left that directory under metadata/ on the destination for good:
prune deleted nothing there.

The blob step of prune, which snapshot create --prune also runs, now
deletes each directory under metadata/ that has no manifest.json.zst,
that no local snapshot record claims, and all of whose objects are
older than prune_grace_period; an object listed with no time keeps its
directory, and only names that are remote keys are deleted. The prompt
and the --force output name each such directory, the --json result
counts them (metadata_dirs_deleted, metadata_dirs_failed), and a failed
delete fails the run. Every description of the grace period now
covers these directories.

Model: opus-5-5

internal/cli/config.go

@@ -239,13 +239,15 @@ storage_url: ""
 # Default: 3
 # compression_level: 3
 
-# How old a blob that no snapshot lists must be before prune deletes it.
-# A backup uploads its blobs before the manifest that lists them, so on a
-# destination shared between hosts or users this must be longer than the
-# longest backup run. It does not protect a blob a backup reuses from an
-# earlier run that stopped before its manifest: that blob keeps the time of
-# its first upload, so a prune can delete it.
-# Accepts: 36h, 90m, etc. 0s deletes them at once.
+# How old a blob that no snapshot lists must be before prune deletes it,
+# and how old every object in a directory under metadata/ with no manifest
+# must be before prune deletes that directory. A backup uploads its blobs
+# and its db.zst.age before its manifest, so on a destination shared
+# between hosts or users this must be longer than the longest backup run.
+# It does not protect a blob a backup reuses from an earlier run that
+# stopped before its manifest: that blob keeps the time of its first
+# upload, so a prune can delete it.
+# Accepts: 36h, 90m, etc. 0s deletes such blobs and directories at once.
 # Default: 24h
 # prune_grace_period: 24h