docs(highlights,notes,opds,progress,analytics): Beam batch 9 — 13 endpoints

Highlights + notes CRUD (media-item scoped, jwt), progress delete,
reading-stats analytics, and the OPDS trio frontmatter'd. OPDS docs are
the first XML entries: example-response intentionally omitted (Atom
responses), gate contract honored via nil-Response registry pins.

Gate fix: group .Use() middleware now parsed (opds.Use(DeviceAuth...
Authenticate) previously resolved to auth 'none'). Registry: 13 entries.
Drift fixed by gate: reading-stats key names (total_reading_time_minutes,
most_active_day_of_week, daily_reading_minutes — draft invented
reading_time_hours/books_completed); notes/highlights list endpoints
return BARE arrays (no {notes:[]}/{highlights:[]} wrapper); create-note
request has no percentage_location/epubcfi_location. New
/tmp/merge_arrays.py handles array-example merges.

make test 9/9.

internal/docs/drift_test.go

@@ -30,6 +30,7 @@ type extractedRoute struct {
 
 var (
 	groupRe      = regexp.MustCompile(`^(\w+)\s*:=\s*(\S+)\.Group\("([^"]*)"(?:,\s*(.+))?\)`)
+	useRe        = regexp.MustCompile(`^(\w+)\.Use\((.+)\)$`)
 	echoRouteRe  = regexp.MustCompile(`^(?:e|cfg\.Echo)\.(GET|POST|PUT|PATCH|DELETE)\("([^"]*)"(?:,\s*(.+))?\)`)
 	groupRouteRe = regexp.MustCompile(`^(\w+)\.(GET|POST|PUT|PATCH|DELETE)\("([^"]*)"(?:,\s*(.+))?\)`)
 )
@@ -94,6 +95,16 @@ func extractRoutesFromRouterSource(t *testing.T) map[string]extractedRoute {
 				continue
 			}
 
+			//opds-style middleware: `grp.Use(cfg.DeviceAuthMiddleware.Authenticate)`
+			//applies to every route registered on that group afterwards.
+			if m := useRe.FindStringSubmatch(s); m != nil {
+				if g, ok := groups[m[1]]; ok {
+					g.middleware = append(g.middleware, splitMW(m[2])...)
+					groups[m[1]] = g
+				}
+				continue
+			}
+
 			if m := echoRouteRe.FindStringSubmatch(s); m != nil {
 				add(m[1], m[2], splitMW(m[3]))
 				continue