test(bruno): sweep the collection against the actual route table

Audited every request (247 .yml files) against the routes the server
actually registers (extracted from internal/router, group prefixes
resolved). Results:

- 44 stale requests: deleted where the endpoint no longer exists
  (universal-progress GET/PUT /api/progress/:id — routes never existed,
  the handlers were deleted in H1; queue stats/clear-failed/process;
  admin profile page; auth/account) and FIXED where the endpoint exists
  under a different path (kobo token-in-path scheme: every
  /api/sync/kobo/<seg> and /api/v1/kobo/<seg> URL now carries
  {{kobo_device_token}}; /sync/* missing their /api prefix; koreader
  /api/v1/koreader/sync/* -> /api/sync/koreader/*; link-book and
  unlinked-books moved to /api/devices/:id/sync/*).
- koreader Sync Highlights/Sync Notes pointed at endpoints that never
  existed with a body shape to match — rewritten against POST
  /api/sync/koreader/bookmarks (the annotations funnel carries
  highlights and notes arrays).
- 9 files the GUI refused to load: 4 had bruno-invalid script type
  "tests" (converted to after-response), 4 were info/type:collection
  doc files with bogus http blocks (converted to folder.yml folder
  docs), 1 had a dead pre-YAML schema and no route (deleted).
- devices/koreader requests now carry request-level bearer auth
  ({{koreader_device_token}}) — they inherited the collection's user-JWT
  bearer, which device endpoints rightly reject — and their bodies
  reference {{media_item_id}} instead of dead placeholder uuids.
- environments: opds_base_url was empty (every OPDS request missed the
  /opds prefix); set to http://localhost:8765/opds and un-doubled the
  prefix in opds/scenarios.

Known limitation, for the handoff: bru CLI cannot execute .yml request
bodies (the collection is GUI OpenCollection format; the CLI runner
reads bodies from .bru files only). A .bru migration is the remaining
bruno work if CLI runs are wanted.

bruno/collections/create-custom-section-missing-fields.yml

@@ -8,16 +8,12 @@ http:
   auth: inherit
   body:
     type: json
-    jsonBody: "{\n  \"library_id\": \"{{library_id}}\",\n  \"icon\": \"📚\"\
-      \n}"
+    jsonBody: "{\n  \"library_id\": \"{{library_id}}\",\n  \"icon\": \"\U0001F4DA\"\n}"
 runtime:
   scripts:
-  - type: tests
-    code: "test(\"status must be 400 with missing name\", function() {\n    expect(res.status).to.eql(400);\n\
-      });\n\ntest(\"response contains error message\", function() {\n    expect(res.body.error).to.exist;\n\
-      \  });"
+  - type: after-response
+    code: "function onResponse(res) {\ntest(\"status must be 400 with missing name\", function() {\n    expect(res.status).to.eql(400);\n});\n\ntest(\"response contains error message\", function() {\n    expect(res.body.error).to.exist;\n  });\n}"
+docs: 'Test error handling when creating a collection without required fields.
 
-docs: |-
-  Test error handling when creating a collection without required fields.
 
-  **Expected Response**: 400 Bad Request with error message.
+  **Expected Response**: 400 Bad Request with error message.'