feat: end-to-end integrity checks with self-healing; website; installer and Windows fixes

Store::verify compares the whole SQLite projection, every table row for
row, against a fresh projection of the journal; verify_and_heal rebuilds a
drifted database (keeping the old file) at every server start and via the
new books.verify tool, which also re-hashes every blob. The GUI checks the
server's database read-only and every stored file, and shows the result.
rebuild() also drops stale WAL/SHM files.

site/: the wanderbooks website (just site, just publish). install.sh:
OS detection (Windows points to WSL2), C compiler and git checks,
WANDERBOOKS_REPO. Windows: no directory fsync off Unix; .exe-aware lookup.
Repo justfile: check, build, install, demo, site.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu

crates/ledger-store/src/blob.rs

@@ -60,9 +60,14 @@ impl BlobStore {
             f.sync_all()?;
         }
         fs::rename(&tmp, &path)?;
-        // Fsync the directory so the rename itself is durable.
-        let dir = fs::File::open(path.parent().unwrap())?;
-        dir.sync_all()?;
+        // Fsync the directory so the rename itself is durable. Unix only:
+        // Windows can't open a directory as a file, and NTFS journals the
+        // rename's metadata itself.
+        #[cfg(unix)]
+        {
+            let dir = fs::File::open(path.parent().unwrap())?;
+            dir.sync_all()?;
+        }
         Ok((sha, false))
     }