refactor: remove dead code across server, templ pages, and client modules

Deadcode-verified removals (RTA reachability from main, cross-checked
with -test and textual xrefs):

Go server:
- whole files: middleware/transaction.go, middleware/error_handler.go,
  middleware/password_validator.go (live registration machinery kept),
  handlers/sync.go, sync/offline.go
- unrouted endpoints: auth UpdateUsername/UpdateEmail, timezone
  settings handler, OPDS RegisterOPDS, Kobo LibrarySync handler,
  ReaderHandler.ShowReader, JSON-data twins on collections/library
- duplicate book-matching handlers (book_matching.go Handler twins,
  matching.go MatchingHandler twins), superseded helpers
  (router.parseUUID, handlers.ValidateDeviceToken, normalizePath,
  userExists, generateLockID)

Templ/client:
- never-routed pages: api_explorer.templ, queue.templ and their
  client modules api-explorer.ts, api-explorer-docs.ts, queue.ts
- fully orphaned wrapper modules events.ts, dom.ts
- broken clearSyncQueue (called a nonexistent endpoint) and the
  hidden, never-populated sync-queue section on the devices page
- 166+ unused exports demoted to private (knip-verified); ~85 truly
  dead declarations removed via tsc noUnusedLocals fixpoint
- stale 'interactive API Explorer' claims dropped from docs

The docs drift-gate package (internal/docs), templ-bound modules
(dashboard, stats, header, index, login, profile*, bookshelf,
collections, toast-error), sqlc-generated code, and web/static are
intentionally untouched.

internal/middleware/device_auth_test.go

@@ -2,45 +2,17 @@ package middleware
 
 import (
 	"bookhoard/internal/database"
-	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/labstack/echo/v5"
 	"github.com/stretchr/testify/assert"
 )
 
-// Mock database for testing device auth middleware
-type mockDeviceDB struct {
-	device database.Devices
-	err    error
-}
-
-func (m *mockDeviceDB) GetDeviceByAuthToken(ctx context.Context, token string) (database.Devices, error) {
-	return m.device, m.err
-}
-
 func TestDeviceAuth_Authenticate_BearerToken(t *testing.T) {
-	deviceID := uuid.New()
-	userID := uuid.New()
 	authToken := "test_bearer_token_123"
 
-	mockDB := &mockDeviceDB{
-		device: database.Devices{
-			ID:          pgtype.UUID{Bytes: [16]byte(deviceID), Valid: true},
-			UserID:      pgtype.UUID{Bytes: [16]byte(userID), Valid: true},
-			DeviceName:  "Test KOReader Device",
-			DeviceType:  "koreader",
-			AuthToken:   authToken,
-			SyncEnabled: pgtype.Bool{Bool: true, Valid: true},
-			AutoSync:    pgtype.Bool{Bool: true, Valid: true},
-		},
-		err: nil,
-	}
-
 	middleware := &DeviceAuthMiddleware{
 		// Can't use mockDB directly due to interface mismatch
 		// In real scenario, would use a mock database or test database
@@ -70,7 +42,6 @@ func TestDeviceAuth_Authenticate_BearerToken(t *testing.T) {
 	// Would call handler(c) and assert results
 	_ = handler
 	_ = c
-	_ = mockDB
 
 	// Test implementation would verify:
 	// 1. Bearer token is extracted correctly
@@ -125,102 +96,3 @@ func TestDeviceAuth_GetRequestType(t *testing.T) {
 		})
 	}
 }
-
-func TestDeviceAuth_HasPermission(t *testing.T) {
-	middleware := &DeviceAuthMiddleware{}
-
-	tests := []struct {
-		name       string
-		deviceType string
-		permission string
-		expected   bool
-	}{
-		{
-			name:       "KOReader progress permission",
-			deviceType: "koreader",
-			permission: "sync:progress",
-			expected:   true,
-		},
-		{
-			name:       "KOReader annotations permission",
-			deviceType: "koreader",
-			permission: "sync:annotations",
-			expected:   true,
-		},
-		{
-			name:       "KOReader metadata permission",
-			deviceType: "koreader",
-			permission: "sync:metadata",
-			expected:   true,
-		},
-		{
-			name:       "Kobo progress permission",
-			deviceType: "kobo",
-			permission: "sync:progress",
-			expected:   true,
-		},
-		{
-			name:       "Kobo annotations permission",
-			deviceType: "kobo",
-			permission: "sync:annotations",
-			expected:   true,
-		},
-		{
-			name:       "Web device manage permission",
-			deviceType: "web",
-			permission: "device:manage",
-			expected:   true,
-		},
-		{
-			name:       "KOReader without manage permission",
-			deviceType: "koreader",
-			permission: "device:manage",
-			expected:   false,
-		},
-		{
-			name:       "Unknown device type",
-			deviceType: "unknown",
-			permission: "sync:progress",
-			expected:   false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := middleware.hasPermission(tt.deviceType, tt.permission)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestDeviceAuth_UpdateLastSeen(t *testing.T) {
-	// This test verifies the middleware structure
-	// In practice, UpdateLastSeen requires a database connection
-	middleware := &DeviceAuthMiddleware{}
-
-	e := echo.New()
-	req := httptest.NewRequest("GET", "/api/sync/koreader/progress", nil)
-	rec := httptest.NewRecorder()
-	c := e.NewContext(req, rec)
-
-	deviceID := uuid.New()
-	c.Set("device_id", [16]byte(deviceID))
-
-	next := func(c *echo.Context) error {
-		// Simulate successful handler execution
-		return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
-	}
-
-	handler := middleware.UpdateLastSeen(next)
-
-	// Note: Without a real database, this will fail when trying to update
-	// This test verifies the middleware structure and flow
-	// In production, would use a test database
-	_ = handler
-	_ = c
-
-	// Verify the device_id was set correctly in context
-	deviceIDBytes, ok := c.Get("device_id").([16]byte)
-	assert.True(t, ok, "device_id should be set in context")
-	assert.Equal(t, [16]byte(deviceID), deviceIDBytes, "device_id should match")
-}