test: add Bruno API test collections for device authentication

- Device token regeneration tests (success, forbidden, not found, unauthorized)
- OPDS authentication tests (Bearer token, query token)
- Kobo sync tests with token authentication
- Test various authentication methods and error cases

bruno/devices/regenerate-token-forbidden.bru

@@ -0,0 +1,26 @@
+meta {
+  name: Regenerate Device Token - Forbidden
+  type: http
+  seq: 3
+}
+
+put {
+  url: {{base_url}}/api/devices/{{other_device_id}}/regenerate-token
+  body: none
+  auth: inherit
+}
+
+docs {
+  ## Regenerate Device Token - Forbidden
+
+  Tests that users cannot regenerate tokens for devices belonging to other users.
+
+  **Expected Behavior:** Returns 403 Forbidden when trying to regenerate token for another user's device
+
+  **Status Codes:**
+  - 403: Forbidden (device belongs to different user)
+
+  **Use Case:** Verify authorization - users can only manage their own devices
+
+  **Setup:** Use Bearer token from user A, try to regenerate token for user B's device
+}

bruno/devices/regenerate-token-notfound.bru

@@ -0,0 +1,26 @@
+meta {
+  name: Regenerate Device Token - Not Found
+  type: http
+  seq: 4
+}
+
+put {
+  url: {{base_url}}/api/devices/00000000-0000-0000-0000-000000000000/regenerate-token
+  body: none
+  auth: bearer
+}
+
+docs {
+  ## Regenerate Device Token - Not Found
+
+  Tests that token regeneration returns 404 for non-existent devices.
+
+  **Expected Behavior:** Returns 404 Not Found when device UUID doesn't exist
+
+  **Status Codes:**
+  - 404: Device not found
+
+  **Use Case:** Verify proper error handling for invalid device IDs
+
+  **Setup:** Use all-zero UUID (guaranteed to not exist in database)
+}

bruno/devices/regenerate-token-unauthorized.bru

@@ -0,0 +1,24 @@
+meta {
+  name: Regenerate Device Token - Unauthorized
+  type: http
+  seq: 2
+}
+
+put {
+  url: {{base_url}}/api/devices/{{device_id}}/regenerate-token
+  body: none
+  auth: none
+}
+
+docs {
+  ## Regenerate Device Token - Unauthorized
+
+  Tests that token regeneration requires authentication.
+
+  **Expected Behavior:** Returns 401 Unauthorized when no Bearer token is provided
+
+  **Status Codes:**
+  - 401: Unauthorized (missing or invalid token)
+
+  **Use Case:** Verify authentication is required for token regeneration
+}

bruno/devices/regenerate-token.bru

@@ -0,0 +1,73 @@
+meta {
+  name: Regenerate Device Token
+  type: http
+  seq: 1
+}
+
+put {
+  url: {{base_url}}/api/devices/{{device_id}}/regenerate-token
+  body: none
+  auth: inherit
+}
+
+docs {
+  ## Regenerate Device Token
+
+  Regenerates auth token for a device, invalidating old token immediately.
+
+  **Method:** PUT
+
+  **Endpoint:** /api/devices/{device_id}/regenerate-token
+
+  **Authentication:** Bearer token (JWT)
+
+  **Path Parameters:**
+  - `device_id` (string): Device UUID
+
+  **Response:**
+  - `message` (string): Success message
+  - `auth_token` (string): New auth token
+  - `device` (object): Updated device details
+  - `sync_urls` (object): Device-specific sync URLs with new token
+
+  **Status Codes:**
+  - 200: Success
+  - 401: Unauthorized
+  - 403: Forbidden (device belongs to different user)
+  - 404: Device not found
+  - 500: Internal server error
+
+  **Important Notes:**
+  - Old token stops working immediately
+  - Device must be updated with new token to resume syncing
+  - No data loss - device ID remains same
+
+  **Example Response:**
+  ```json
+  {
+    "message": "Token regenerated successfully",
+    "auth_token": "dev_abc123...",
+    "device": {
+      "id": "uuid-here",
+      "device_name": "My Kobo Clara",
+      "device_type": "kobo",
+      "sync_enabled": true,
+      "auto_sync": true,
+      "sync_frequency_minutes": 5,
+      "created_at": "2026-02-12T10:00:00Z",
+      "device_metadata": "{...}"
+    },
+    "sync_urls": {
+      "sync_url": "http://localhost:8765/api/sync/kobo/dev_new_token",
+      "markup": "http://localhost:8765/api/sync/kobo/dev_new_token/markup",
+      "bookmark": "http://localhost:8765/api/sync/kobo/dev_new_token/bookmark",
+      "init": "http://localhost:8765/api/sync/kobo/dev_new_token/v1/initialization"
+    }
+  }
+  ```
+
+  **Important Notes:**
+  - Old token stops working immediately
+  - Device must be updated with new token to resume syncing
+  - No data loss - device ID remains same
+}