feat(persist): persist BankBook under banks key, retire legacy bank_index, route capture to active bank (B2)

src/bank_book.h

@@ -190,6 +190,22 @@ public:
     // shape going forward; the legacy key is retired by the B2 shell).
     static std::optional<BankBook> deserialize(const std::string& json);
 
+    // Resolve a BankBook from the two persisted ext-state values a project may carry:
+    // the authoritative `banks` blob and the retired-but-possibly-present legacy
+    // `bank_index` blob. The persist shell (B2) hands both raw strings straight here so
+    // the load-source decision stays REAPER-free and unit-tested. Precedence:
+    //   1. non-empty `banksJson` present  -> deserialize it (authoritative). If it is
+    //      MALFORMED, do NOT silently fall back to the legacy blob — a corrupt `banks`
+    //      blob is an error, not an absence; return an empty book so a stale legacy key
+    //      can never resurrect a superseded single-bank state over a broken book.
+    //   2. else non-empty `legacyJson`    -> deserialize it (one-way pool migration).
+    //   3. else (both absent/empty)        -> a fresh empty book (pool only).
+    // Never returns nullopt: an unloadable input degrades to the empty book (matching
+    // the shell's existing "malformed -> ignore, start empty" behaviour), so the caller
+    // has one branchless install path.
+    static BankBook loadFromPersisted(const std::string& banksJson,
+                                      const std::string& legacyJson);
+
 private:
     std::vector<Bank> banks_;         // ordinal order; banks_[0] is always the pool
     std::string       activeBankId_;  // always names a live bank; defaults to pool