P2 slice 8: the viewer's menu, setup, no confinement (D-32)

No Landlock, no seccomp, no helper: isolation is "same_user
(advisory)". The lease socket keeps two intents (close, format-upgrade
consent). The viewer holds the books open while it runs and gains a
Books menu: New books, Back up now, Restore (preview, then confirm),
Close, Connect Claude Code / Codex. New commands `wanderbooks books
back-up` and `wanderbooks connect claude|codex`. The scaffold
(`new`/`init` and its templates) is gone; install.sh needs no sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-gui/src/app.rs

@@ -147,6 +147,8 @@ pub struct App {
     live_label: bool,
     /// The export menu (menu.rs).
     menu: crate::menu::Menu,
+    /// The owner's Books menu (owner.rs).
+    owner_menu: crate::owner::OwnerMenu,
 }
 
 impl App {
@@ -191,6 +193,7 @@ impl App {
             updated_at: -1e9,
             live_label: false,
             menu: Default::default(),
+            owner_menu: Default::default(),
         }
     }
 
@@ -644,6 +647,7 @@ impl App {
                     if let Some(b) = &books {
                         ui.add_space(2.0);
                         self.menu.ui(ui, b, false);
+                        self.owner_menu.ui(ui, b, false);
                     }
                     ui.add_space(6.0);
                     if let Some(b) = &books {
@@ -742,6 +746,7 @@ impl App {
                     self.scheme_menu(ui, true);
                     if let Some(b) = &books {
                         self.menu.ui(ui, b, true);
+                        self.owner_menu.ui(ui, b, true);
                     }
                     ui.add_space(6.0);
                     if let Some(b) = &books {