P2 slice 8: the viewer's menu, setup, no confinement (D-32)

No Landlock, no seccomp, no helper: isolation is "same_user
(advisory)". The lease socket keeps two intents (close, format-upgrade
consent). The viewer holds the books open while it runs and gains a
Books menu: New books, Back up now, Restore (preview, then confirm),
Close, Connect Claude Code / Codex. New commands `wanderbooks books
back-up` and `wanderbooks connect claude|codex`. The scaffold
(`new`/`init` and its templates) is gone; install.sh needs no sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-config/src/lib.rs

@@ -1,7 +1,8 @@
 //! Company settings from the books dir's `wanderbooks.toml`.
 //!
-//! `wanderbooks init` writes that file next to `books-data/`; onboarding
-//! fills in `[company]`. The server reads the company name (report headers),
+//! An older books dir keeps that file next to `books-data/` until
+//! `books.import_settings` moves it into the journal (books of the data
+//! root never read one). The server reads the company name (report headers),
 //! the fiscal year start (fiscal-year-to-date reports), the members of a
 //! multi-member LLC (`[[company.members]]`: name, share, capital account —
 //! for the statement of members' equity), `[books] accounting_basis`