refactor: remove dead code across server, templ pages, and client modules

Deadcode-verified removals (RTA reachability from main, cross-checked
with -test and textual xrefs):

Go server:
- whole files: middleware/transaction.go, middleware/error_handler.go,
  middleware/password_validator.go (live registration machinery kept),
  handlers/sync.go, sync/offline.go
- unrouted endpoints: auth UpdateUsername/UpdateEmail, timezone
  settings handler, OPDS RegisterOPDS, Kobo LibrarySync handler,
  ReaderHandler.ShowReader, JSON-data twins on collections/library
- duplicate book-matching handlers (book_matching.go Handler twins,
  matching.go MatchingHandler twins), superseded helpers
  (router.parseUUID, handlers.ValidateDeviceToken, normalizePath,
  userExists, generateLockID)

Templ/client:
- never-routed pages: api_explorer.templ, queue.templ and their
  client modules api-explorer.ts, api-explorer-docs.ts, queue.ts
- fully orphaned wrapper modules events.ts, dom.ts
- broken clearSyncQueue (called a nonexistent endpoint) and the
  hidden, never-populated sync-queue section on the devices page
- 166+ unused exports demoted to private (knip-verified); ~85 truly
  dead declarations removed via tsc noUnusedLocals fixpoint
- stale 'interactive API Explorer' claims dropped from docs

The docs drift-gate package (internal/docs), templ-bound modules
(dashboard, stats, header, index, login, profile*, bookshelf,
collections, toast-error), sqlc-generated code, and web/static are
intentionally untouched.

internal/handlers/auth.go

@@ -14,7 +14,6 @@ import (
 	"math"
 	"net/http"
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -837,31 +836,6 @@ func (h *AuthHandler) AdminCreateUser(c *echo.Context) error {
 	})
 }
 
-// normalizePath cleans and normalizes folder paths for consistent storage and comparison
-func normalizePath(path string) string {
-	fmt.Printf("normalizePath input: '%s'\n", path)
-
-	var cleaned string
-	// Handle home directory expansion (~)
-	if strings.HasPrefix(path, "~/") {
-		// Keep the original path for ~ to preserve user's formatting
-		// Just normalize separators and that's it
-		cleaned = strings.ReplaceAll(path, "\\", "/")
-	} else {
-		// Clean the path to remove redundant separators, ., .. etc.
-		cleaned = filepath.Clean(path)
-		// Convert to consistent path separators (use forward slashes for storage)
-		cleaned = strings.ReplaceAll(cleaned, "\\", "/")
-		// Remove trailing slash unless it's root path
-		if len(cleaned) > 1 && strings.HasSuffix(cleaned, "/") {
-			cleaned = strings.TrimSuffix(cleaned, "/")
-		}
-	}
-
-	fmt.Printf("normalizePath output: '%s'\n", cleaned)
-	return cleaned
-}
-
 type UpdateThemeRequest struct {
 	Theme string `json:"theme" validate:"required"`
 }
@@ -889,74 +863,6 @@ func (h *AuthHandler) UpdateTheme(c *echo.Context) error {
 	return c.JSON(http.StatusOK, map[string]string{"message": "theme updated successfully"})
 }
 
-type UpdateUsernameRequest struct {
-	Username string `json:"username" validate:"required,min=3,max=50"`
-}
-
-// UpdateUsername handles PUT /api/auth/username
-func (h *AuthHandler) UpdateUsername(c *echo.Context) error {
-	user := MustGetAuthenticatedUser(c)
-
-	var req UpdateUsernameRequest
-	if err := c.Bind(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
-	}
-
-	// Check if username is already taken by another user
-	existingUser, err := h.db.GetUserByUsername(c.Request().Context(), req.Username)
-	if err == nil && existingUser.ID.Bytes != user.ID.Bytes {
-		return c.JSON(http.StatusConflict, map[string]string{"error": "username already taken"})
-	}
-
-	// Update username
-	err = h.db.UpdateUsername(c.Request().Context(), database.UpdateUsernameParams{
-		ID:       user.ID,
-		Username: req.Username,
-	})
-	if err != nil {
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
-	}
-
-	return c.JSON(http.StatusOK, map[string]string{"message": "username updated successfully"})
-}
-
-type UpdateEmailRequest struct {
-	Email string `json:"email" validate:"required,email"`
-}
-
-// UpdateEmail handles PUT /api/auth/email
-func (h *AuthHandler) UpdateEmail(c *echo.Context) error {
-	user := MustGetAuthenticatedUser(c)
-
-	var req UpdateEmailRequest
-	if err := c.Bind(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request"})
-	}
-	if err := c.Validate(&req); err != nil {
-		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
-	}
-
-	// Check if email is already taken by another user
-	existingUser, err := h.db.GetUserByEmail(c.Request().Context(), req.Email)
-	if err == nil && existingUser.ID.Bytes != user.ID.Bytes {
-		return c.JSON(http.StatusConflict, map[string]string{"error": "email already taken"})
-	}
-
-	// Update email
-	err = h.db.UpdateEmail(c.Request().Context(), database.UpdateEmailParams{
-		ID:    user.ID,
-		Email: req.Email,
-	})
-	if err != nil {
-		return c.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
-	}
-
-	return c.JSON(http.StatusOK, map[string]string{"message": "email updated successfully"})
-}
-
 type UpdatePasswordRequest struct {
 	CurrentPassword string `json:"current_password" validate:"required"`
 	NewPassword     string `json:"new_password" validate:"required,passwordcomplex"`