refactor!: one way to serve books: the stdio server is gone (D-44)

The owner (2026-10-23): "We should probably just delete the stdio path
altogether. THere's no point in that. And it sitting there unused will
just lead to bitrot. Nuke it?"

Books are served only by the books server (`wanderbooks server`),
reached by agents through the bridge (`wanderbooks mcp --book ID`),
which stays.

Removed: `wanderbooks dev-stdio`, the `ledger-mcp` binary, and
`ledger_mcp::run` (stdio and `--http` over a bare data dir), with all
that only that mode had:
- files the books make coming back inline: `HandedFile.content_base64`
  is gone, and `download` and `expires_at` are always there;
- books with no access log or backups: `books.access_log`,
  `books.backup` and `books.back_up_now` are always offered, by scope;
- the settings file read and reloaded (`legacy_files`), the vault key
  named by a file or `--vault-key-file`, and the books dir's
  key-inside-the-books and git checks (with `paths.rs`);
- `wire.rs` (the bridge frames an agent's lines itself);
- `books.settings`' file fields and `books.start`'s `settings_source`.

`BooksServer` is built one way, from `Served` (a book as the books
server serves it), in production and in the unit tests. An unknown tool
is now a protocol error (mcp-tools.md). Inline file input is unchanged.

Then the owner's three decisions (2026-10-23, the question tool):
(a) `books.import_settings` is removed entirely (118 tools): old books
come in whole by `wanderbooks books adopt`, which reads their settings
file once; ledger-config keeps its settings-file parsing only as far as
adoption uses it (`load` and the path-reading `effective_receipt_policy`
are gone), and `books.chart_template` gives its settings as
`books.set_setting` changes. (b) The viewer's loose-books-folder mode is
removed (`--data-dir`, `--books-toml`, `--vault-key-file`, the settings
file and config.json followed): it opens only books of the data root,
reading settings from the journal and the vault from the book's own
`vault/` and `keys/`. (c) `wanderbooks dev-stdio` has no stub: it is an
unknown command like any other word. Also: an upload's expiry past the
calendar is an error, never an empty string.

Tests: every suite that drove the stdio server moved to
crates/ledger-cli/tests/ and drives a real `wanderbooks server` on a
data root of its own (tests/common), handed files by their download;
mcp_stdio.rs is mcp_journeys.rs. Tests of what is gone are deleted and
listed in docs/testing.md. Docs: plan D-44 (D-18 superseded), STATUS,
testing, rules, mcp-interface, the handbook, README; justfile recipes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

README.md

@@ -16,8 +16,10 @@ through MCP. Self-hosted, no rent.
   append-only, hash-chained JSONL journal; SQLite is a disposable
   projection rebuilt from it; receipts live in a content-addressed blob
   store. Drafts are durable, corrupt projections self-heal.
-- **`ledger-mcp`** — the AI-first interface. 64 MCP tools over stdio or
-  Streamable HTTP: draft → preview → post workflow, server-side receipt
+- **`ledger-mcp`** — the AI-first interface. 118 MCP tools, served by the
+  books server (`wanderbooks server`) on the data root's local sockets and
+  reached through the agents' bridge (`wanderbooks mcp --book ID`): draft →
+  preview → post workflow, server-side receipt
   policy (>$25), anti-splitting detection, asset management, digest for
   human review, plus read-only resources for dashboards.
 - **`ledger-import`** — QuickBooks interop. Import bank/credit-card CSVs
@@ -38,7 +40,8 @@ This is the storytold way applied to accounting: agents verify against
 oracles, never ship what they haven't demonstrated.
 
 - 190+ workspace tests: invariant tests encoding accounting law, golden-file
-  report snapshots, property tests (proptest), end-to-end MCP stdio tests.
+  report snapshots, property tests (proptest), end-to-end MCP tests through
+  a real books server.
 - **Formal proofs of the accounting laws** (`just prove`,
   `docs/verification.md`). Kani model-checks the engine's arithmetic
   kernel exhaustively within bounds. Lean 4 proves that, after any
@@ -68,9 +71,8 @@ See [`plan/STATUS.md`](plan/STATUS.md) for where things stand and
 ## Quickstart
 
 ```bash
-cargo test          # whole suite
-cargo run -p ledger-mcp -- --data-dir /tmp/books   # MCP server over stdio
-cargo run -p ledger-gui -- --demo                   # the viewer, on a demo company
+cargo test                         # whole suite
+cargo run -p ledger-gui -- --demo  # the viewer, on a demo company
 ```
 New books, one command (installs Rust and wanderbooks if needed, makes the
 books' private folder, starts books called `acme` and lets Claude Code reach
@@ -100,7 +102,7 @@ just          # lists the recipes: check, build, prove, demo, ...
 ```
 crates/ledger-core/    # engine: money, accounts, journal, ledger, reports
 crates/ledger-store/   # journal + SQLite projection + blob store
-crates/ledger-mcp/     # MCP server: 119 tools, resources, handbook, receipt policy
+crates/ledger-mcp/     # MCP server: 118 tools, resources, handbook, receipt policy
 crates/ledger-import/  # QBO CSV import, IIF/XLSX export
 crates/ledger-config/  # wanderbooks.toml company settings
 crates/ledger-cli/     # `wanderbooks`: the one executable (every mode)