docs(users): live-smoke correction — GET /api/auth/users emits sqlc ListUsersRow, no password_hash

Curated smoke run of the generated collection against the live dev
server (37/37 after fixes): registration matrix (409 duplicate email,
403 admin-creation-with-admins-present, 400 weak password), non-admin
403s, device-token/opds 401s, collection CRUD incl. the documented 201
update quirk and 204 delete, stats routes, scanner, jobs, malformed-uuid
400s. Testuser untouched (password test uses a guaranteed-wrong current
password -> 401); the smoke user was admin-deleted in cleanup and its
token verified dead.

Correction the smoke run forced: the batch-8 'password_hash leak' was a
false alarm — my registry pin ([]database.Users) never matched the
handler, which returns []database.ListUsersRow (sqlc join with
device_count). Live response confirmed: id/email/username/theme/names/
role/max_devices/created_at/updated_at/device_count — NO hash. Doc
example, field table, and registry pin all corrected; leak note
replaced with the live-verified statement.

Also verified via the real Bruno CLI: 9 safe generated requests
(4 shown passing incl. stats/collections/devices; password-rules
public) execute against the server with collection-level auth.
Full-collection bru run deliberately not attempted (mutations in
static bodies would touch live data).

internal/docs/schema.go

@@ -687,7 +687,9 @@ var Schemas = map[string]Schema{
 		}`),
 	},
 	"GET /api/auth/users": {
-		Response: []database.Users{},
+		// sqlc join row (device_count), NOT database.Users — no password_hash
+		// on the wire (live-smoke-verified 2026-10-24).
+		Response: []database.ListUsersRow{},
 	},
 	"PUT /api/auth/users/:id/max-devices": {
 		Request:  handlers.UpdateUserMaxDevicesRequest{},