test(bruno): sweep the collection against the actual route table

Audited every request (247 .yml files) against the routes the server
actually registers (extracted from internal/router, group prefixes
resolved). Results:

- 44 stale requests: deleted where the endpoint no longer exists
  (universal-progress GET/PUT /api/progress/:id — routes never existed,
  the handlers were deleted in H1; queue stats/clear-failed/process;
  admin profile page; auth/account) and FIXED where the endpoint exists
  under a different path (kobo token-in-path scheme: every
  /api/sync/kobo/<seg> and /api/v1/kobo/<seg> URL now carries
  {{kobo_device_token}}; /sync/* missing their /api prefix; koreader
  /api/v1/koreader/sync/* -> /api/sync/koreader/*; link-book and
  unlinked-books moved to /api/devices/:id/sync/*).
- koreader Sync Highlights/Sync Notes pointed at endpoints that never
  existed with a body shape to match — rewritten against POST
  /api/sync/koreader/bookmarks (the annotations funnel carries
  highlights and notes arrays).
- 9 files the GUI refused to load: 4 had bruno-invalid script type
  "tests" (converted to after-response), 4 were info/type:collection
  doc files with bogus http blocks (converted to folder.yml folder
  docs), 1 had a dead pre-YAML schema and no route (deleted).
- devices/koreader requests now carry request-level bearer auth
  ({{koreader_device_token}}) — they inherited the collection's user-JWT
  bearer, which device endpoints rightly reject — and their bodies
  reference {{media_item_id}} instead of dead placeholder uuids.
- environments: opds_base_url was empty (every OPDS request missed the
  /opds prefix); set to http://localhost:8765/opds and un-doubled the
  prefix in opds/scenarios.

Known limitation, for the handoff: bru CLI cannot execute .yml request
bodies (the collection is GUI OpenCollection format; the CLI runner
reads bodies from .bru files only). A .bru migration is the remaining
bruno work if CLI runs are wanted.

bruno/collections/preview-collection.yml

@@ -8,53 +8,9 @@ http:
   auth: inherit
   body:
     type: json
-    jsonBody: "{\n  \"library_id\": \"{{library_id}}\",\n  \"rules\": [\n\
-      {\n      \"id\": \"rule1\",\n      \"field\": \"genre\",\n\
-      \"operator\": \"equals\",\n      \"value\": \"Fiction\",\n\
-      \"priority\": 1\n    }\n  ],\n  \"manual_book_ids\": [],\n  \"limit\": 20\n}"
+    jsonBody: "{\n  \"library_id\": \"{{library_id}}\",\n  \"rules\": [\n{\n      \"id\": \"rule1\",\n      \"field\": \"genre\",\n\"operator\": \"equals\",\n      \"value\": \"Fiction\",\n\"priority\": 1\n    }\n  ],\n  \"manual_book_ids\": [],\n  \"limit\": 20\n}"
 runtime:
   scripts:
-  - type: tests
-    code: "test(\"status must be 200 with valid request\", function() {\n    expect(res.status).to.eql(200);\n\
-      });\n\ntest(\"response contains items array\", function() {\n    expect(res.body.items).to.exist;\n\
-         expect(res.body.items).to.be.an('array');\n  });"
-
-docs: |-
-  Preview collection with filter rules before saving.
-
-  **Endpoint**: POST /api/collections/preview
-  **Auth**: Required (Bearer token)
-
-  ## Request Body
-
-  | Field | Type | Required | Description |
-  |-------|------|----------|-------------|
-  | library_id | string | Yes | Library UUID |
-  | rules | array | No | Filter rules to evaluate |
-  | manual_book_ids | array | No | Manually selected book IDs |
-  | limit | int | No | Max items to return (default: 20, max: 100) |
-
-  ## Example Request
-
-  ```json
-  {
-    "library_id": "cc23c3a7-f8fb-451a-a78d-2a16df1b725a",
-    "rules": [
-      {
-        "id": "rule1",
-        "field": "genre",
-        "operator": "equals",
-        "value": "Fiction",
-        "priority": 1
-      }
-    ],
-    "manual_book_ids": [],
-    "limit": 20
-  }
-  ```
-
-  ## Response
-
-  Returns array of matching book items.
-
-  This endpoint is used by the Custom Section Builder to show users what books will match their filter rules before they save the collection.
+  - type: after-response
+    code: "function onResponse(res) {\ntest(\"status must be 200 with valid request\", function() {\n    expect(res.status).to.eql(200);\n});\n\ntest(\"response contains items array\", function() {\n    expect(res.body.items).to.exist;\nexpect(res.body.items).to.be.an('array');\n  });\n}"
+docs: "Preview collection with filter rules before saving.\n\n**Endpoint**: POST /api/collections/preview\n**Auth**: Required (Bearer token)\n\n## Request Body\n\n| Field | Type | Required | Description |\n|-------|------|----------|-------------|\n| library_id | string | Yes | Library UUID |\n| rules | array | No | Filter rules to evaluate |\n| manual_book_ids | array | No | Manually selected book IDs |\n| limit | int | No | Max items to return (default: 20, max: 100) |\n\n## Example Request\n\n```json\n{\n  \"library_id\": \"cc23c3a7-f8fb-451a-a78d-2a16df1b725a\",\n  \"rules\": [\n    {\n      \"id\": \"rule1\",\n      \"field\": \"genre\",\n      \"operator\": \"equals\",\n      \"value\": \"Fiction\",\n      \"priority\": 1\n    }\n  ],\n  \"manual_book_ids\": [],\n  \"limit\": 20\n}\n```\n\n## Response\n\nReturns array of matching book items.\n\nThis endpoint is used by the Custom Section Builder to show users what books will match their filter rules before they save the collection."