docs(scanner): Beam batch 7 — all 10 scanner endpoints backfilled

Scanner surface frontmatter'd (scan/start/stop/cancel/status/active/
active-summary + watch start/stop/status) with provenance comments;
active-summary on a non-admin group.

Claude registry: 10 entries. Fixed handler drift Beam missed: scan_library
request has no "recursive"; scanner/start binds folder_paths (not
invented interval_seconds); scanner/stop binds no body; response is
{message, job_id, status} with 409 coalescing variant
{error, active_job_id}.

Gate fix in drift_test seed: registerScannerRoutes group seeds used bare
"jwt"/"admin" tokens invisible to authLabel; and silently passed before
only because the seeded set was unchecked. Seeds now 'jwtMiddleware'/
'AdminMiddleware' markers. Also: cleanup of a stale-merge-script residue
in collections/update_rule.md example (extra null keys). make test 9/9.

docs/developer/api/scanner/scan_library.md

@@ -1,3 +1,11 @@
+---
+method: POST
+path: /api/scanner/scan
+auth: jwt+admin
+area: scanner
+---
+<!-- source: internal/handlers/scanner.go:34 Handler.ScanLibrary -->
+
 # Scan Library
 
 Initiate a one-time scan of a library for ebooks, manga, or comics.
@@ -26,25 +34,26 @@ The scanner automatically detects and processes files based on the library type:
 
 ### Example Request
 
-```json
+```json example-request
 {
   "library_id": "550e8400-e29b-41d4-a716-446655440000",
-  "recursive": true,
   "force": false
 }
 ```
 
 ## Response (202 Accepted)
 
-```json
+```json example-response
 {
-  "message": "Scan initiated successfully",
-  "job_id": "uuid",
-  "library_id": "uuid",
+  "message": "scan job enqueued",
+  "job_id": "b3d3a0c2-8f4e-4c1d-9a2b-6e5f1a7c9d01",
   "status": "pending"
 }
 ```
 
+A scan for the same library already pending or running returns **409** with
+`{"error": "a scan for this library is already pending or running", "active_job_id": "..."}`.
+
 ## Error Responses
 
 | Code | Description                         |