docs(scanner): Beam batch 7 — all 10 scanner endpoints backfilled

Scanner surface frontmatter'd (scan/start/stop/cancel/status/active/
active-summary + watch start/stop/status) with provenance comments;
active-summary on a non-admin group.

Claude registry: 10 entries. Fixed handler drift Beam missed: scan_library
request has no "recursive"; scanner/start binds folder_paths (not
invented interval_seconds); scanner/stop binds no body; response is
{message, job_id, status} with 409 coalescing variant
{error, active_job_id}.

Gate fix in drift_test seed: registerScannerRoutes group seeds used bare
"jwt"/"admin" tokens invisible to authLabel; and silently passed before
only because the seeded set was unchecked. Seeds now 'jwtMiddleware'/
'AdminMiddleware' markers. Also: cleanup of a stale-merge-script residue
in collections/update_rule.md example (extra null keys). make test 9/9.

internal/docs/drift_test.go

@@ -70,8 +70,11 @@ func extractRoutesFromRouterSource(t *testing.T) map[string]extractedRoute {
 		// names the call site actually passes (router.go: protected=/api jwt,
 		// admin=/api jwt+admin).
 		if base == "scanner.go" {
-			groups["protected"] = group{prefix: "/api", middleware: []string{"jwt"}}
-			groups["admin"] = group{prefix: "/api", middleware: []string{"jwt", "admin"}}
+			// Middleware values must carry the marker substrings authLabel
+			// matches on (AdminMiddleware, createJWTMiddleware) — the seeded
+			// "jwt"/"admin" tokens were invisible to it.
+			groups["protected"] = group{prefix: "/api", middleware: []string{"jwtMiddleware"}}
+			groups["admin"] = group{prefix: "/api", middleware: []string{"jwtMiddleware", "AdminMiddleware"}}
 		}
 		raw, err := os.ReadFile(file)
 		if err != nil {