refactor!: one way to serve books: the stdio server is gone (D-44)

The owner (2026-10-23): "We should probably just delete the stdio path
altogether. THere's no point in that. And it sitting there unused will
just lead to bitrot. Nuke it?"

Books are served only by the books server (`wanderbooks server`),
reached by agents through the bridge (`wanderbooks mcp --book ID`),
which stays.

Removed: `wanderbooks dev-stdio`, the `ledger-mcp` binary, and
`ledger_mcp::run` (stdio and `--http` over a bare data dir), with all
that only that mode had:
- files the books make coming back inline: `HandedFile.content_base64`
  is gone, and `download` and `expires_at` are always there;
- books with no access log or backups: `books.access_log`,
  `books.backup` and `books.back_up_now` are always offered, by scope;
- the settings file read and reloaded (`legacy_files`), the vault key
  named by a file or `--vault-key-file`, and the books dir's
  key-inside-the-books and git checks (with `paths.rs`);
- `wire.rs` (the bridge frames an agent's lines itself);
- `books.settings`' file fields and `books.start`'s `settings_source`.

`BooksServer` is built one way, from `Served` (a book as the books
server serves it), in production and in the unit tests. An unknown tool
is now a protocol error (mcp-tools.md). Inline file input is unchanged.

Then the owner's three decisions (2026-10-23, the question tool):
(a) `books.import_settings` is removed entirely (118 tools): old books
come in whole by `wanderbooks books adopt`, which reads their settings
file once; ledger-config keeps its settings-file parsing only as far as
adoption uses it (`load` and the path-reading `effective_receipt_policy`
are gone), and `books.chart_template` gives its settings as
`books.set_setting` changes. (b) The viewer's loose-books-folder mode is
removed (`--data-dir`, `--books-toml`, `--vault-key-file`, the settings
file and config.json followed): it opens only books of the data root,
reading settings from the journal and the vault from the book's own
`vault/` and `keys/`. (c) `wanderbooks dev-stdio` has no stub: it is an
unknown command like any other word. Also: an upload's expiry past the
calendar is an error, never an empty string.

Tests: every suite that drove the stdio server moved to
crates/ledger-cli/tests/ and drives a real `wanderbooks server` on a
data root of its own (tests/common), handed files by their download;
mcp_stdio.rs is mcp_journeys.rs. Tests of what is gone are deleted and
listed in docs/testing.md. Docs: plan D-44 (D-18 superseded), STATUS,
testing, rules, mcp-interface, the handbook, README; justfile recipes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

justfile

@@ -21,12 +21,14 @@ check: sweep-test-tmp
     @just sweep-test-tmp
 
 # The server-only build (plan D-22, for another machine) builds, passes
-# clippy and its tests, and links no window libraries
+# clippy and the one executable's own tests, and links no window libraries.
+# The books server's tool suites (mcp_journeys, spec_*, oracle_mcp,
+# hostile_args, ...: the same binary's server, D-44) run once, in `check`.
 server-only:
     #!/usr/bin/env bash
     set -euo pipefail
     cargo clippy -p ledger-cli --no-default-features --all-targets -- -D warnings
-    cargo test -p ledger-cli --no-default-features
+    cargo test -p ledger-cli --no-default-features --bins --test one_executable --test setup --test local_server --test open_while_held --test backups --test format_upgrade --test startup
     tree=$(cargo tree -p ledger-cli --no-default-features -e normal)
     if grep -qiE '\b(eframe|egui|winit|wgpu|glow|ledger-gui)\b' <<<"$tree"; then
         echo "the server-only build links a window library" >&2
@@ -196,11 +198,12 @@ mutants-config shard="0/1": sweep-test-tmp
     PROPTEST_MAX_SHRINK_ITERS=0 TMPDIR={{mutants_tmp}} cargo mutants -p ledger-config --test-package ledger-config -j 4 --timeout-multiplier 3 --minimum-test-timeout 120 --shard {{shard}} -o mutants-config
     @just sweep-test-tmp
 
-# Mutation testing of the MCP server (every mutant runs the stdio suites;
-# fewer random cases each, as for the store).
+# Mutation testing of the MCP server: every mutant runs its unit tests and
+# the suites that drive a real books server (ledger-cli's tests, D-44),
+# built without the viewer; fewer random cases each, as for the store.
 mutants-mcp shard="0/1": sweep-test-tmp
     mkdir -p {{mutants_tmp}}
-    MCP_CASES=16 PROPTEST_MAX_SHRINK_ITERS=0 TMPDIR={{mutants_tmp}} cargo mutants -p ledger-mcp --test-package ledger-mcp -j 4 --timeout-multiplier 3 --minimum-test-timeout 600 --shard {{shard}} -o mutants-mcp
+    MCP_CASES=16 PROPTEST_MAX_SHRINK_ITERS=0 TMPDIR={{mutants_tmp}} cargo mutants -p ledger-mcp --test-package ledger-mcp --test-package ledger-cli --no-default-features -j 4 --timeout-multiplier 3 --minimum-test-timeout 600 --shard {{shard}} -o mutants-mcp
     @just sweep-test-tmp
 
 # No mutation runs on the viewer (owner, 2026-10-18: they crushed the
@@ -215,13 +218,14 @@ bench:
     cargo bench -p ledger-core --bench books
     cargo bench -p ledger-store --bench store
 
-# Build the release binaries (CLI, MCP server, GUI)
+# Build the release binaries (`wanderbooks`, the one executable, and the
+# viewer's own)
 build:
-    cargo build --release -p ledger-cli -p ledger-mcp -p ledger-gui
+    cargo build --release -p ledger-cli -p ledger-gui
 
 # Install the binaries from this checkout into ~/.cargo/bin
 install:
-    for c in ledger-cli ledger-mcp ledger-gui; do cargo install --locked --path crates/$c; done
+    for c in ledger-cli ledger-gui; do cargo install --locked --path crates/$c; done
 
 # Open the GUI on the demo company
 demo: