feat(nh3-dev): /srv/nemi/books book drop (fiction/ nonfiction/ rejected/) for albok unit 8

servers/nh3-dev/README.md

@@ -240,6 +240,17 @@ carries `u:lkraven:rx`.
 for lkraven, NOT through the group. Do not "simplify" them away until lkraven's user manager has restarted.
 `playbooks/nh3-dev-nemi-inbox.yaml` verifies both paths.
 
+## `/srv/nemi/books`: the book drop (2026-10-16)
+
+albok unit 8 (albok-dev, after Prime asked for a books drop folder with a rejection folder). Drop an epub into `fiction/` or
+`nonfiction/`. Nemi validates it and moves it into `~lkraven/library/<shelf>/`, writing its yaml and MANIFEST line, then walks it
+the same hour. If it refuses the file, it moves it into `rejected/` beside a reason file. Files are examined only after
+2 minutes unchanged, and temporary names (dotfiles, `.part`, `.crdownload`, `.tmp`, `~`, `.syncthing.*`) are ignored.
+Same shape as the inbox: all four dirs are `lkraven:nemi-drop 2770` with the default ACL. Same filesystem as `~/library`
+(`/dev/sda1`), so Nemi's move is a rename. There is no network share: drops are local writes or `scp`/`sftp` as lkraven, as
+for the inbox. `playbooks/nh3-dev-nemi-books.yaml` provisions it and verifies an infra-ops drop is readable, movable
+to `rejected/` and removable by lkraven.
+
 ## `/srv/nemi/vault`: Prime's notes for Nemi (2026-10-15)
 
 A fresh clone of gitea `vh/VuongKB` (Prime's notes, which he syncs with git; his working copy is `/home/lkraven/kb`, never