refactor: remove dead code across server, templ pages, and client modules

Deadcode-verified removals (RTA reachability from main, cross-checked
with -test and textual xrefs):

Go server:
- whole files: middleware/transaction.go, middleware/error_handler.go,
  middleware/password_validator.go (live registration machinery kept),
  handlers/sync.go, sync/offline.go
- unrouted endpoints: auth UpdateUsername/UpdateEmail, timezone
  settings handler, OPDS RegisterOPDS, Kobo LibrarySync handler,
  ReaderHandler.ShowReader, JSON-data twins on collections/library
- duplicate book-matching handlers (book_matching.go Handler twins,
  matching.go MatchingHandler twins), superseded helpers
  (router.parseUUID, handlers.ValidateDeviceToken, normalizePath,
  userExists, generateLockID)

Templ/client:
- never-routed pages: api_explorer.templ, queue.templ and their
  client modules api-explorer.ts, api-explorer-docs.ts, queue.ts
- fully orphaned wrapper modules events.ts, dom.ts
- broken clearSyncQueue (called a nonexistent endpoint) and the
  hidden, never-populated sync-queue section on the devices page
- 166+ unused exports demoted to private (knip-verified); ~85 truly
  dead declarations removed via tsc noUnusedLocals fixpoint
- stale 'interactive API Explorer' claims dropped from docs

The docs drift-gate package (internal/docs), templ-bound modules
(dashboard, stats, header, index, login, profile*, bookshelf,
collections, toast-error), sqlc-generated code, and web/static are
intentionally untouched.

cmd/server/tests/security_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-playground/validator/v10"
 	"github.com/labstack/echo/v5"
 	"github.com/stretchr/testify/assert"
 )
@@ -29,7 +30,13 @@ func TestPasswordComplexity(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := ratelimit.ValidatePassword(tt.password)
+			// Exercise the live path: the passwordcomplex tag the auth request
+			// structs use, registered exactly the way main.go registers it.
+			v := validator.New()
+			if err := ratelimit.RegisterPasswordValidation(v); err != nil {
+				t.Fatalf("failed to register password validation: %v", err)
+			}
+			err := v.Var(tt.password, "required,passwordcomplex")
 			if tt.valid {
 				assert.NoError(t, err, "Password should be valid")
 			} else {
@@ -139,23 +146,3 @@ func TestRefreshTokenExpiration(t *testing.T) {
 	expectedDuration := 7 * 24 * time.Hour
 	assert.Equal(t, expectedDuration, 168*time.Hour, "Refresh token expiration is 7 days")
 }
-
-// TestPasswordRequirementsList tests password requirements documentation
-func TestPasswordRequirementsList(t *testing.T) {
-	requirements := ratelimit.GetPasswordRequirements()
-
-	assert.NotEmpty(t, requirements, "Password requirements list should not be empty")
-	assert.Equal(t, 5, len(requirements), "Should have 5 password requirements")
-}
-
-// TestDatabaseTransactionManager tests transaction manager creation
-func TestDatabaseTransactionManager(t *testing.T) {
-	// Verify the transaction manager type exists
-	assert.True(t, true, "Transaction manager structure verified")
-}
-
-// TestErrorHandlingTypes tests error handling types
-func TestErrorHandlingTypes(t *testing.T) {
-	// Verify error types exist
-	assert.True(t, true, "Error handling types verified")
-}