docs(media-items): Work Order 3 batch 3b — management endpoints (8)

New frontmatter'd docs:
- download (ServeFile — raw bytes, family-lens enforced; corrects the old
  download doc's claim that no download route is registered: ServeFile IS
  routed, DownloadBook is the dead code)
- set_audio_speed (speed range 0.25-4.0, NaN/Inf rejected)
- rescan (abridged example over the full 70+-column row; write-after-success
  guarantee noted)
- purge-archived (destructive, admin), unarchive (204), merge (SHA-256
  precondition, per-user collisions keep active copy)
- facets (two modes: facet+values, field autocomplete counts)
- filter_count (family lens)

Registry: RawMessage pins for map/abridged responses; Schema{} for non-JSON
body routes (download = raw bytes; unarchive = 204). Audit now:
missing docs down to ~55 (from 112), 0 orphans.

docs/developer/api/media-items/download_media_item_file.md

@@ -0,0 +1,26 @@
+---
+method: GET
+path: /api/media-items/:id/download
+auth: jwt
+area: media-items
+---
+<!-- source: internal/handlers/media.go:2766 MediaHandler.ServeFile -->
+
+# Download Media Item File
+
+Serves the book file itself (epub, pdf, …) for the given media item, enforced
+against the requester's **visible-library set** (family lens). This is the
+registered route — distinct from the dead `MediaHandler.DownloadBook` code
+path referenced by pre-2026 docs.
+
+Success is the raw file bytes with the file's MIME type. There is no JSON
+body.
+
+## Errors
+
+| Status | Body | When |
+| ------ | ---- | ---- |
+| 400 | `{"error": "invalid library ID"}` / `{"error": "invalid path"}` / `{"error": "invalid media item ID"}` | malformed ids |
+| 403 | `{"error": "library not accessible"}` | library outside the visible set |
+| 404 | `{"error": "book not found"}` / `{"error": "book file not found"}` / `{"error": "file not found"}` | missing row or file on disk |
+| 500 | `{"error": "failed to check library access"}` | unexpected server error |