P2 slice 8: the viewer's menu, setup, no confinement (D-32)

No Landlock, no seccomp, no helper: isolation is "same_user
(advisory)". The lease socket keeps two intents (close, format-upgrade
consent). The viewer holds the books open while it runs and gains a
Books menu: New books, Back up now, Restore (preview, then confirm),
Close, Connect Claude Code / Codex. New commands `wanderbooks books
back-up` and `wanderbooks connect claude|codex`. The scaffold
(`new`/`init` and its templates) is gone; install.sh needs no sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

Cargo.lock

@@ -3825,8 +3825,6 @@ name = "ledger-cli"
 version = "0.1.0"
 dependencies = [
  "base64 0.22.1",
- "chrono",
- "ledger-config",
  "ledger-core",
  "ledger-gui",
  "ledger-host",
@@ -3840,7 +3838,6 @@ dependencies = [
  "sha2 0.10.9",
  "tempfile",
  "tokio",
- "toml 1.1.8+spec-1.1.0",
 ]
 
 [[package]]