fix: validate UUIDs in OPDS middleware before authentication

- Add UUID validation in device_auth middleware for OPDS routes
- Return 400 Bad Request for invalid device/book IDs instead of 401
- Remove redundant UUID validation from OPDS handlers (middleware handles it)

internal/middleware/device_auth.go

@@ -42,6 +42,24 @@ func (m *DeviceAuthMiddleware) Authenticate(next echo.HandlerFunc) echo.HandlerF
 		var urlToken string
 		var queryToken string
 
+		// For OPDS routes, validate deviceId is a valid UUID before authentication
+		// This allows returning 400 Bad Request for invalid UUIDs instead of 401
+		if strings.HasPrefix(c.Request().URL.Path, "/opds/devices/") {
+			deviceID := c.Param("deviceId")
+			if deviceID != "" {
+				if _, err := uuid.Parse(deviceID); err != nil {
+					return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid device ID"})
+				}
+			}
+			// Also validate bookId for download, cover, and formats endpoints
+			bookID := c.Param("bookId")
+			if bookID != "" {
+				if _, err := uuid.Parse(bookID); err != nil {
+					return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid book ID"})
+				}
+			}
+		}
+
 		// Method 1: Try Bearer token header (KOReader, API clients, OPDS)
 		authHeader := c.Request().Header.Get("Authorization")
 		if authHeader != "" {