feat(albok-service): library building (fiction, nonfiction) for unit 4.5; widened Nemi and albok-dev tokens minted

stacks/albok-service/README.md

@@ -113,6 +113,12 @@ Verified: wings came up `drwxr-s--- albok:albok-read` / `albok:albok-personal`,
 **Secrets (vault):** `albok/litellm-key`, a LiteLLM key scoped to `qwen3-embedding` only (alias
 `albok-service`; verified 200 on embeddings, 403 on any other model; widened 2026-10-05 to also cover `qwen3-embedding-bulk`, the write-path alias, c0d3384); `albok/bootstrap-admin-token`,
 the first-start admin token (also at `/srv/albok/private/bootstrap-admin-token`, 0600).
+**Building `library` (2026-10-09, albok-dev ask, unit 4.5 Nemi books):** wings `library/fiction` and `library/nonfiction`,
+`default_group: albok-read` (1510), neither restricted, no encrypted mount; live config `albok.yaml.pre-library` kept.
+Token grants are immutable, so the widening was done by minting NEW tokens: nemi `01M4HAP9G90J79HBRJB6VW6PQA` (previous six
+grants plus read+write on both library wings) and albok-dev `01M4HAP9HFYZCFV76WX2HPVWT2` (`write:fleet/memory`, `read:fleet/*`,
+`read:library/*`), vaulted over `albok/token-nemi` / `albok/token-albok-dev`. albok-dev swaps them into nemi.yaml and
+albok-check, then revokes the previous nemi `01M40JWJ3NZ6VJ77KS8B06BCYZ` and albok-dev `01M3ZMCXE8P66MRX16MZN1D44D`.
 **Nemi (albok's tagger, runs on nh3-dev):** `albok/token-nemi`, a service token minted 0255 with read+write on
 `fleet/memory`, `fleet/stash` and `personal/agent-feedback`; it sees exactly those three wings (`personal/notes` hidden).
 The previous token (`01M40979…`, without agent-feedback) is still live until albok-dev revokes it.

stacks/albok-service/conf/albok.yaml.template

@@ -52,3 +52,8 @@ buildings:
       - id: agent-feedback            # auto-memory (Nemi's third source); restricted, default-deny (2026-10-03)
         restricted: true
         group: albok-feedback         # host gid 1512
+  - id: library                       # unit 4.5 (Nemi books), albok-dev ask 2026-10-09: epubs from nh3-dev ~/library
+    default_group: albok-read         # host gid 1510, readable like fleet; neither wing restricted, no encrypted mount
+    wings:
+      - id: fiction
+      - id: nonfiction