test(bruno): sweep the collection against the actual route table

Audited every request (247 .yml files) against the routes the server
actually registers (extracted from internal/router, group prefixes
resolved). Results:

- 44 stale requests: deleted where the endpoint no longer exists
  (universal-progress GET/PUT /api/progress/:id — routes never existed,
  the handlers were deleted in H1; queue stats/clear-failed/process;
  admin profile page; auth/account) and FIXED where the endpoint exists
  under a different path (kobo token-in-path scheme: every
  /api/sync/kobo/<seg> and /api/v1/kobo/<seg> URL now carries
  {{kobo_device_token}}; /sync/* missing their /api prefix; koreader
  /api/v1/koreader/sync/* -> /api/sync/koreader/*; link-book and
  unlinked-books moved to /api/devices/:id/sync/*).
- koreader Sync Highlights/Sync Notes pointed at endpoints that never
  existed with a body shape to match — rewritten against POST
  /api/sync/koreader/bookmarks (the annotations funnel carries
  highlights and notes arrays).
- 9 files the GUI refused to load: 4 had bruno-invalid script type
  "tests" (converted to after-response), 4 were info/type:collection
  doc files with bogus http blocks (converted to folder.yml folder
  docs), 1 had a dead pre-YAML schema and no route (deleted).
- devices/koreader requests now carry request-level bearer auth
  ({{koreader_device_token}}) — they inherited the collection's user-JWT
  bearer, which device endpoints rightly reject — and their bodies
  reference {{media_item_id}} instead of dead placeholder uuids.
- environments: opds_base_url was empty (every OPDS request missed the
  /opds prefix); set to http://localhost:8765/opds and un-doubled the
  prefix in opds/scenarios.

Known limitation, for the handoff: bru CLI cannot execute .yml request
bodies (the collection is GUI OpenCollection format; the CLI runner
reads bodies from .bru files only). A .bru migration is the remaining
bruno work if CLI runs are wanted.

bruno/library/browse-folders.yml

@@ -1,52 +0,0 @@
-meta:
-  name: Browse library folders
-  type: http
-  seq: 1
-config:
-  test:
-    filter: "response.status == 200"
-    assertions:
-      - type: stddev
-        target: response_time
-        threshold: 1000
-      - type: jsonpath
-        expression: response.directories
-        condition: exists
-      - type: jsonpath
-        expression: response.current_path
-        condition: exists
-      - type: jsonpath
-        expression: response.parent_path
-        condition: exists
-req:
-  method: GET
-  url: "{{base_url}}/api/libraries/browse?path=/tmp"
-  headers:
-    Authorization: "Bearer {{ADMIN_TOKEN}}"
-
-docs: |-
-  ## Browse Library Folders
-  
-    Navigates through the filesystem to browse folders for library configuration.
-  
-    **Method:** GET
-  
-    **Endpoint:** /api/libraries/browse
-  
-    **Authentication:** Required (Bearer token, Admin only)
-  
-    **Query Parameters:**
-    - `path` (string, required): Filesystem path to browse
-  
-    **Response:**
-    - `current_path` (string): Current browsing path
-    - `parent_path` (string): Parent directory path
-    - `directories` (array): List of subdirectories
-    - `files` (array): List of files (optional)
-  
-    **Status Codes:**
-    - 200: Success
-    - 400: Invalid path
-    - 401: Unauthorized
-    - 403: Forbidden (admin access required)
-    - 404: Path not found