Say what a backup needs on an rclone remote and fix four more findings

- `README.md`, `docs/REPOSTRUCTURE.md`, `internal/cli/snapshot.go`: a
  backup needs only write permission on S3; an rclone remote that can
  move objects also needs read and delete, and an upload there stops
  when its look-up is refused.
- `docs/DATAMODEL.md`, `docs/REPOSTRUCTURE.md`: a restore reads no
  file, chunk or blob rows from the local index, but it does open it.
- `README.md`: confirmation prompts go to stdout.
- `internal/cli/remote.go`: `remote nuke` leaves the backup destination
  store empty, not a bucket prefix.
- `README.md`: a TODO section, as `REPO_POLICIES.md` requires.

Model: fable-5-1

docs/DATAMODEL.md

@@ -11,8 +11,8 @@ The local index has two jobs:
 - It is the source of each snapshot's own database. A backup uploads a trimmed,
   encrypted copy of the index with every snapshot.
 
-A restore does not need the local index. It reads the copy that was uploaded
-with the snapshot.
+A restore reads no file, chunk or blob rows from the local index. It reads the
+copy that was uploaded with the snapshot.
 
 ## Terms