refactor: rename diigo-dump to diigo-cache

Pure rename ahead of the dump worker's evolution into a bookmark cache
(goal 1c), so history follows the files. The diigo-login helper script
is dropped: the cookie now enters through webapp's mint form, never a
local script.

diigo-cache/README.md

@@ -0,0 +1,57 @@
+# diigo-dump
+
+Cloudflare Worker consumer of [the webapp factory](../webapp/README.md):
+the site-side of dumping [Diigo bookmarks from the mm-diigo provenance
+scripts](https://github.com/dckc/mm-diigo) (`projects/diigo-bak/`) —
+session-cookie access, most-recently-updated first. The static API-key
+path is dead (both known keys, all documented schemes → 401; see
+[the capsite checklist](../capsite-checklist.md), goal 2 preamble).
+
+## What it holds
+
+**Only the diigo flavoring** — everything generic lives in webapp:
+
+- the mint call: `url` = `https://www.diigo.com/interact_api/`, seed
+  headers `{user-agent, x-requested-with}` (+ the cookie at mint time),
+  `msPerCall: 500`
+- the dump page: page-number form → `WEBAPP.at(id)` → pipelined
+  `pathjoin("load_user_items").query({sort, count, page_num}).get()`
+- the `DiigoBridge` entrypoint (`open()`, `dumpNdjson()`) for other
+  workers; `dumpBookmarks` (the generator from mm-diigo's
+  diigo-dump.mjs) is in `src/diigo.ts`
+
+GET `/` is inert; dumps happen only on POST submits.
+
+## State surface
+
+- The instance id (`DIIGO_WEB_ID`): the one secret (bearer capability;
+  possession is authority). Not logged.
+- The cookie: lives **only in the webapp DO's storage**, crosses the wire
+  exactly once, at mint time. Nothing on disk holds it.
+- `/_connect`: state-aware — pre-mint it's the paste-cookie form;
+  post-mint it health-checks the instance (count=1 probe) and offers
+  re-mint only for stale cookies.
+
+## RPC use (from another worker, same account)
+
+```jsonc
+// wrangler.jsonc of the caller
+"services": [{ "binding": "DIIGO", "service": "diigo-dump", "entrypoint": "DiigoBridge" }]
+```
+
+```ts
+const stub = await env.DIIGO.open();
+// promise pipelining: whole chain = one round trip; cookie never leaves the DO
+const first = JSON.parse(await stub.pathjoin("load_user_items")
+	.query({ sort: "updated", count: 24, page_num: 1 }).get());
+```
+
+## Run, deploy
+
+[How to run / connect / deploy is maintained in the capsite checklist]
+(../capsite-checklist.md) (single source; this README keeps only
+worker-level facts).
+
+Status: dev wiring verified (boots, pages answer); mint → dump through
+the DO not yet exercised end-to-end (checklist 1b-i). Earlier flat
+(non-DO) build passed manual test: 200, `total: 1674` (2026-10-06).