feat(albok): personal/inbox wing on nh3-albok + /srv/nemi/inbox capture root on nh3-dev (unit 4.4 slice C, gate 2)

Prime ruled albok subsumes note intake (1530). The wing is like personal/notes
(albok-personal 1511, not service-restricted); health reads 7 wings ready.
Nemi's token was re-minted with read+write on the new wing and vaulted over
albok/token-nemi. /srv/nemi/inbox is lkraven:nemi-drop 2770 with a default ACL,
plus u:lkraven:rx on /srv/nemi, so Nemi reaches it from lkraven's user manager,
whose groups predate nemi-drop. Both paths are verified by the playbook.

stacks/albok-service/README.md

@@ -126,6 +126,15 @@ grants plus read+write on both library wings) and albok-dev `01M4HAP9HFYZCFV76WX
 `read:library/*`), vaulted over `albok/token-nemi` / `albok/token-albok-dev`. albok-dev swaps them into nemi.yaml and
 albok-check (swapped 1459, proven by the 1503 walk) and revoked the previous nemi `01M40JWJ3NZ6VJ77KS8B06BCYZ` and
 albok-dev `01M3ZMCXE8P66MRX16MZN1D44D` at 1555 10-09. Live set: bootstrap-admin, svos-knowledge-nh3-svos, the new nemi, the new albok-dev.
+**Wing `personal/inbox` (2026-10-13, unit 4.4 slice C's capture target, albok-dev's ask after Prime's 1530 intake ruling):**
+like `personal/notes`, so `default_group: albok-personal` (1511) and not service-restricted. The hiding is the sensitivity
+classes plus Nemi's `restricted_wings`. vh reads it through 1511, and no API token besides Nemi's holds it. The live
+config backup is `albok.yaml.pre-inbox`; added by `playbooks/albok-personal-inbox.yaml`, with health reading 7 wings
+ready. Nemi's token was re-minted for it: `01M4VX207PJ09ZSECASCSZPCFE`, its previous ten grants plus read+write on
+`personal/inbox`, vaulted over `albok/token-nemi`. The previous nemi token `01M4HAP9G90J79HBRJB6VW6PQA` stays live
+until albok-dev has swapped and asks for its revocation. The capture ROOT is on nh3-dev: `/srv/nemi/inbox`
+(`playbooks/nh3-dev-nemi-inbox.yaml`).
+
 **Nemi (albok's tagger, runs on nh3-dev):** `albok/token-nemi`, a service token minted 0255 with read+write on
 `fleet/memory`, `fleet/stash` and `personal/agent-feedback`; it sees exactly those three wings (`personal/notes` hidden).
 The previous token (`01M40979…`, without agent-feedback) is still live until albok-dev revokes it.

stacks/albok-service/conf/albok.yaml.template

@@ -49,6 +49,7 @@ buildings:
     default_group: albok-personal     # host gid 1511
     wings:
       - id: notes
+      - id: inbox                     # unit 4.4 capture wing (Nemi's drop-box /srv/nemi/inbox on nh3-dev); like notes (2026-10-13)
       - id: agent-feedback            # auto-memory (Nemi's third source); restricted, default-deny (2026-10-03)
         restricted: true
         group: albok-feedback         # host gid 1512