refactor: remove dead code across server, templ pages, and client modules

Deadcode-verified removals (RTA reachability from main, cross-checked
with -test and textual xrefs):

Go server:
- whole files: middleware/transaction.go, middleware/error_handler.go,
  middleware/password_validator.go (live registration machinery kept),
  handlers/sync.go, sync/offline.go
- unrouted endpoints: auth UpdateUsername/UpdateEmail, timezone
  settings handler, OPDS RegisterOPDS, Kobo LibrarySync handler,
  ReaderHandler.ShowReader, JSON-data twins on collections/library
- duplicate book-matching handlers (book_matching.go Handler twins,
  matching.go MatchingHandler twins), superseded helpers
  (router.parseUUID, handlers.ValidateDeviceToken, normalizePath,
  userExists, generateLockID)

Templ/client:
- never-routed pages: api_explorer.templ, queue.templ and their
  client modules api-explorer.ts, api-explorer-docs.ts, queue.ts
- fully orphaned wrapper modules events.ts, dom.ts
- broken clearSyncQueue (called a nonexistent endpoint) and the
  hidden, never-populated sync-queue section on the devices page
- 166+ unused exports demoted to private (knip-verified); ~85 truly
  dead declarations removed via tsc noUnusedLocals fixpoint
- stale 'interactive API Explorer' claims dropped from docs

The docs drift-gate package (internal/docs), templ-bound modules
(dashboard, stats, header, index, login, profile*, bookshelf,
collections, toast-error), sqlc-generated code, and web/static are
intentionally untouched.

internal/middleware/password_validator.go

@@ -2,7 +2,6 @@ package middleware
 
 import (
 	"bookhoard/internal/database"
-	"fmt"
 	"regexp"
 	"sync"
 
@@ -45,11 +44,6 @@ func (v *PasswordValidator) rules() database.PasswordRules {
 	return database.PasswordRules{MinLength: 8, Upper: true, Lower: true, Number: true, Special: true}
 }
 
-// Validate checks if a password meets the configured complexity requirements.
-func (v *PasswordValidator) Validate(fl validator.FieldLevel) bool {
-	return v.CheckPassword(fl.Field().String())
-}
-
 // CheckPassword applies the active rules to a single password.
 func (v *PasswordValidator) CheckPassword(password string) bool {
 	r := v.rules()
@@ -71,61 +65,9 @@ func (v *PasswordValidator) CheckPassword(password string) bool {
 	return true
 }
 
-// GetPasswordRequirements returns a human-readable list of the active password
-// requirements, driven by the configured rules when a registry is wired.
-func GetPasswordRequirements() []string {
-	return defaultPasswordValidator.Requirements()
-}
-
-// Requirements returns the human-readable list for the receiver's active rules.
-func (v *PasswordValidator) Requirements() []string {
-	r := v.rules()
-	var out []string
-	out = append(out, fmt.Sprintf("At least %d characters long", r.MinLength))
-	if r.Upper {
-		out = append(out, "At least one uppercase letter (A-Z)")
-	}
-	if r.Lower {
-		out = append(out, "At least one lowercase letter (a-z)")
-	}
-	if r.Number {
-		out = append(out, "At least one number (0-9)")
-	}
-	if r.Special {
-		out = append(out, "At least one special character (!@#$%^&*()_+-=[]{}|;':\",./<>?)")
-	}
-	return out
-}
-
-// ValidatePassword checks a password against the default (hardcoded) rules and
-// returns an error describing the first unmet requirement. Retained for callers
-// that don't have access to a configured PasswordValidator instance.
-func ValidatePassword(password string) error {
-	v := defaultPasswordValidator
-	r := v.rules()
-	if len(password) < r.MinLength {
-		return fmt.Errorf("password must be at least %d characters long", r.MinLength)
-	}
-	if r.Upper && !regexp.MustCompile(`[A-Z]`).MatchString(password) {
-		return fmt.Errorf("password must contain at least one uppercase letter")
-	}
-	if r.Lower && !regexp.MustCompile(`[a-z]`).MatchString(password) {
-		return fmt.Errorf("password must contain at least one lowercase letter")
-	}
-	if r.Number && !regexp.MustCompile(`[0-9]`).MatchString(password) {
-		return fmt.Errorf("password must contain at least one number")
-	}
-	if r.Special && !specialRegex().MatchString(password) {
-		return fmt.Errorf("password must contain at least one special character")
-	}
-	return nil
-}
-
-// defaultPasswordValidator is used by the package-level helpers
-// (GetPasswordRequirements, ValidatePassword) and as the fallback inside
-// RegisterPasswordValidation when no registry has been wired. Callers that want
-// live rule updates should construct their own PasswordValidator and call
-// SetSettings.
+// defaultPasswordValidator backs the passwordcomplex struct tag registered by
+// RegisterPasswordValidation. Callers that want live rule updates should
+// construct their own PasswordValidator and call SetSettings.
 var defaultPasswordValidator = &PasswordValidator{}
 
 // RegisterPasswordValidation registers the password validator with the
@@ -138,9 +80,9 @@ func RegisterPasswordValidation(v *validator.Validate) error {
 }
 
 // SetDefaultPasswordSettings wires the settings registry into the package-level
-// default validator so that the struct-tag validator (used by echo's
-// CustomValidator) and ValidatePassword follow live configuration. Intended to
-// be called once at startup.
+// default validator so that the passwordcomplex struct-tag validator (used by
+// echo's CustomValidator) follows live configuration. Intended to be called
+// once at startup.
 func SetDefaultPasswordSettings(s *database.SettingsRegistry) {
 	defaultPasswordValidator.SetSettings(s)
 }