test: add Bruno API test collections for device authentication

- Device token regeneration tests (success, forbidden, not found, unauthorized)
- OPDS authentication tests (Bearer token, query token)
- Kobo sync tests with token authentication
- Test various authentication methods and error cases

bruno/sync-kobo/sync-bookmark-url-token.bru

@@ -0,0 +1,57 @@
+meta {
+  name: Sync Bookmark - URL Path Token
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{base_url}}/sync/kobo/{{kobo_device_token}}/bookmark
+  body: json
+  auth: none
+}
+
+headers {
+  Content-Type: application/json
+}
+
+body:json {
+  {
+    "ContentId": "book-uuid",
+    "BookmarkText": "Highlighted text",
+    "BookmarkType": "annotation",
+    "BookmarkTitle": "Chapter 3"
+  }
+}
+
+docs {
+  ## Sync Bookmark - URL Path Token
+
+  Synchronizes bookmarks and annotations from Kobo device using token in URL path.
+
+  **Method:** POST
+
+  **Endpoint:** /sync/kobo/{kobo_device_token}/bookmark
+
+  **Authentication:** URL path parameter (Kobo devices never send Bearer tokens)
+
+  **Path Parameters:**
+  - `kobo_device_token` (string): Device auth token from devices.auth_token
+
+  **Request Body:**
+  - `ContentId` (string): Book UUID
+  - `BookmarkText` (string): Highlighted or annotated text
+  - `BookmarkType` (string): Type (annotation, bookmark, note)
+  - `BookmarkTitle` (string): Title for the bookmark
+
+  **Response:** Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 401: Unauthorized
+  - 403: Device sync disabled
+  - 500: Internal server error
+
+  **Important:** Kobo devices use URL path token exclusively, never Bearer header
+
+  **Use Case:** Kobo devices syncing bookmarks and highlights via stock firmware
+}