Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is not present: snapshot create refuses before
writing, prune and snapshot purge fail, and snapshot list and snapshot
remove warn, as for a destination that cannot be listed. remote nuke
deletes the marker last. The file:// backend no longer creates its
destination directory and checks for it on every write.

Tests that backed up into a directory they never created now use an
existing one; fixtures standing for a written destination carry the
marker.

Judgement call: the marker is rewritten on every backup.
Deviation: snapshot name selection moved out of CreateSnapshot unchanged, for the complexity limit.

Model: opus-5-5

internal/storage/storer.go

@@ -41,7 +41,8 @@ type Info struct {
 // directory for filesystem).
 type Storer interface {
 	// Put stores data at the specified key.
-	// Parent directories are created automatically for filesystem backends.
+	// The filesystem backend fails when its destination directory does
+	// not exist, and creates the directories below it as needed.
 	Put(ctx context.Context, key string, data io.Reader) error
 
 	// PutWithProgress stores data with progress reporting.