test: add Bruno API test collections for device authentication

- Device token regeneration tests (success, forbidden, not found, unauthorized)
- OPDS authentication tests (Bearer token, query token)
- Kobo sync tests with token authentication
- Test various authentication methods and error cases

bruno/sync-kobo/get-initialization-url-token.bru

@@ -0,0 +1,40 @@
+meta {
+  name: Kobo Initialization - URL Path Token
+  type: http
+  seq: 4
+}
+
+get {
+  url: {{base_url}}/sync/kobo/{{kobo_device_token}}/v1/initialization
+  body: none
+  auth: none
+}
+
+docs {
+  ## Kobo Initialization - URL Path Token
+
+  Returns initialization data for Kobo device using token in URL path.
+
+  **Method:** GET
+
+  **Endpoint:** /sync/kobo/{kobo_device_token}/v1/initialization
+
+  **Authentication:** URL path parameter (Kobo devices never send Bearer tokens)
+
+  **Path Parameters:**
+  - `kobo_device_token` (string): Device auth token from devices.auth_token
+
+  **Response:** Initialization configuration and settings
+
+  **Status Codes:**
+  - 200: Success (initialization data)
+  - 401: Unauthorized
+  - 403: Device sync disabled
+  - 404: Device not found
+
+  **Important:** Kobo devices use URL path token exclusively, never Bearer header
+
+  **Use Case:** Kobo devices initializing sync connection via stock firmware
+
+  **Note:** This endpoint is called when Kobo first connects to sync server
+}

bruno/sync-kobo/get-library-url-token.bru

@@ -0,0 +1,38 @@
+meta {
+  name: Get Library - URL Path Token
+  type: http
+  seq: 3
+}
+
+get {
+  url: {{base_url}}/sync/kobo/{{kobo_device_token}}/library
+  body: none
+  auth: none
+}
+
+docs {
+  ## Get Kobo Library - URL Path Token
+
+  Retrieves library metadata for Kobo device using token in URL path.
+
+  **Method:** GET
+
+  **Endpoint:** /sync/kobo/{kobo_device_token}/library
+
+  **Authentication:** URL path parameter (Kobo devices never send Bearer tokens)
+
+  **Path Parameters:**
+  - `kobo_device_token` (string): Device auth token from devices.auth_token
+
+  **Response:** Library metadata with book list
+
+  **Status Codes:**
+  - 200: Success (library metadata)
+  - 401: Unauthorized
+  - 403: Device sync disabled
+  - 404: Device not found
+
+  **Important:** Kobo devices use URL path token exclusively, never Bearer header
+
+  **Use Case:** Kobo devices retrieving library information via stock firmware
+}

bruno/sync-kobo/sync-bookmark-url-token.bru

@@ -0,0 +1,57 @@
+meta {
+  name: Sync Bookmark - URL Path Token
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{base_url}}/sync/kobo/{{kobo_device_token}}/bookmark
+  body: json
+  auth: none
+}
+
+headers {
+  Content-Type: application/json
+}
+
+body:json {
+  {
+    "ContentId": "book-uuid",
+    "BookmarkText": "Highlighted text",
+    "BookmarkType": "annotation",
+    "BookmarkTitle": "Chapter 3"
+  }
+}
+
+docs {
+  ## Sync Bookmark - URL Path Token
+
+  Synchronizes bookmarks and annotations from Kobo device using token in URL path.
+
+  **Method:** POST
+
+  **Endpoint:** /sync/kobo/{kobo_device_token}/bookmark
+
+  **Authentication:** URL path parameter (Kobo devices never send Bearer tokens)
+
+  **Path Parameters:**
+  - `kobo_device_token` (string): Device auth token from devices.auth_token
+
+  **Request Body:**
+  - `ContentId` (string): Book UUID
+  - `BookmarkText` (string): Highlighted or annotated text
+  - `BookmarkType` (string): Type (annotation, bookmark, note)
+  - `BookmarkTitle` (string): Title for the bookmark
+
+  **Response:** Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 401: Unauthorized
+  - 403: Device sync disabled
+  - 500: Internal server error
+
+  **Important:** Kobo devices use URL path token exclusively, never Bearer header
+
+  **Use Case:** Kobo devices syncing bookmarks and highlights via stock firmware
+}

bruno/sync-kobo/sync-markup-url-token.bru

@@ -0,0 +1,62 @@
+meta {
+  name: Sync Markup - URL Path Token
+  type: http
+  seq: 1
+}
+
+post {
+  url: {{base_url}}/sync/kobo/{{kobo_device_token}}/markup
+  body: json
+  auth: none
+}
+
+headers {
+  Content-Type: application/json
+}
+
+body:json {
+  {
+    "ReadingSync": [
+      {
+        "ContentId": "book-uuid",
+        "PercentRead": 45.6,
+        "EntitlementId": "entitlement-id",
+        "RemainingTimeMinutes": 120,
+        "FirstReadTime": "2026-01-25T10:00:00Z",
+        "LastModified": "2026-01-30T20:00:00Z"
+      }
+    ],
+    "BookmarkSync": []
+  }
+}
+
+docs {
+  ## Sync Reading Progress - URL Path Token
+
+  Synchronizes reading progress from Kobo device using token in URL path.
+
+  **Method:** POST
+
+  **Endpoint:** /sync/kobo/{kobo_device_token}/markup
+
+  **Authentication:** URL path parameter (Kobo devices never send Bearer tokens)
+
+  **Path Parameters:**
+  - `kobo_device_token` (string): Device auth token from devices.auth_token
+
+  **Request Body:**
+  - `ReadingSync` (array): Reading progress data
+  - `BookmarkSync` (array): Bookmarks and annotations
+
+  **Response:** Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 401: Unauthorized
+  - 403: Device sync disabled
+  - 500: Internal server error
+
+  **Important:** Kobo firmware requires token in URL path, cannot use Bearer header
+
+  **Use Case:** Kobo devices syncing reading progress via stock firmware
+}