P2 slice 8: the viewer's menu, setup, no confinement (D-32)

No Landlock, no seccomp, no helper: isolation is "same_user
(advisory)". The lease socket keeps two intents (close, format-upgrade
consent). The viewer holds the books open while it runs and gains a
Books menu: New books, Back up now, Restore (preview, then confirm),
Close, Connect Claude Code / Codex. New commands `wanderbooks books
back-up` and `wanderbooks connect claude|codex`. The scaffold
(`new`/`init` and its templates) is gone; install.sh needs no sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-host/src/lib.rs

@@ -5,18 +5,17 @@
 //! the **host**, which starts the books server and holds it open while
 //! any lease on its socket lasts, and closes it 10 s after the last one
 //! ends. Each part is a mode of the one `wanderbooks` executable:
-//! [`host::run`] (`wanderbooks host`), [`helper::run`] (`wanderbooks
-//! helper`), [`bridge::run`] (`wanderbooks mcp`), and the commands in
-//! [`commands`] (`serve`, `close`, `books`, `token`). Agents' tokens are
-//! kept in the OS keyring ([`tokens`]).
+//! [`host::run`] (`wanderbooks host`), [`bridge::run`] (`wanderbooks
+//! mcp`), and the owner's commands in [`commands`] (`serve`, `close`,
+//! `books`, `token`, `connect`, `doctor`, `passphrase`, and what the
+//! viewer's Books menu does). Agents' tokens are kept in the OS keyring
+//! ([`tokens`]).
 
 #[cfg(unix)]
 pub mod bridge;
 #[cfg(unix)]
 pub mod commands;
 #[cfg(unix)]
-pub mod helper;
-#[cfg(unix)]
 pub mod host;
 pub mod knobs;
 pub mod lease;