fix: restore original route paths and parameters

Revert unauthorized route changes made during router refactoring:

Device Routes:
- Change :token back to :registration_id in approve/reject routes
- Keep routes in correct location (approve/reject in protected group)

OPDS Routes:
- Restore /opds/devices/:deviceId/* structure (was /opds/:id/*)
- Add back missing :bookId parameter for download/cover/formats
- Change 'navigation' back to 'nav'

Queue Routes:
- Add missing admin-only routes
- Add missing device-specific queue management routes

All routes now match original main.go signatures exactly.
Breaking changes reverted - API contract restored.

internal/router/device.go

@@ -8,18 +8,18 @@ func registerDeviceRoutes(cfg *Config) {
 
 	// Protected routes
 	protected := e.Group("/api", jwtMiddleware)
+	devices := protected.Group("/devices")
 
 	// Public device registration routes (no auth required)
 	e.POST("/api/devices/register", cfg.DeviceHandler.InitiateRegistration)
 	e.POST("/api/devices/register/status", cfg.DeviceHandler.CheckRegistrationStatus)
-	e.GET("/api/devices/approve/:token", cfg.DeviceHandler.ApproveDevice)
-	e.POST("/api/devices/reject/:token", cfg.DeviceHandler.RejectDevice)
 
 	// Device management routes (protected)
-	devices := protected.Group("/devices")
 	devices.GET("", cfg.DeviceHandler.ListDevices)
 	devices.GET("/:id", cfg.DeviceHandler.GetDevice)
 	devices.PUT("/:id", cfg.DeviceHandler.UpdateDevice)
 	devices.DELETE("/:id", cfg.DeviceHandler.DeleteDevice)
 	devices.GET("/pending", cfg.DeviceHandler.ListPendingRegistrations)
+	devices.GET("/approve/:registration_id", cfg.DeviceHandler.ApproveDevice)
+	devices.POST("/reject/:registration_id", cfg.DeviceHandler.RejectDevice)
 }