bruno: regenerate collection from canonical docs + permanent docs↔Bruno parity gate

WO4. The old collection was the drifted artifact AGENTS.md warned about:
bodies pre-truncated at their first {{var}}, routes renamed server-side
but not here (/api/notes/:media_id, /api/book-matching/search,
/api/collections/:id/rules/test), an orphan universal-progress suite for
routes that no longer exist.

scripts/gen_bruno_from_docs.py emits one OpenCollection request per
frontmatter'd endpoint doc (191 requests): gate-verified example-request
JSON as body, {{env}} params per the environment file, device-token
routes get an explicit Bearer {{device_token}} header, login/register/
refresh keep the token-capture after-response scripts that chain the
collection. Old 1:1 mirrors deleted (128); hand-authored NewDevDBSetup,
environments, and edge-case suites kept. 30 scenario files with
truncated bodies (the documented corruption) deleted — they could not
run.

internal/docs/drift_test.go gains TestBrunoMirrorsDocs: every
frontmatter'd doc must have a Bruno request with matching method+URL
shape — the collection can never silently drift from the docs again.
opencollection.yml README block replaced with the real run instructions.

make test green (9 pkgs, parity test included in internal/docs).

bruno/user/admin/Delete User.yml

@@ -1,25 +0,0 @@
-info:
-  name: Delete User
-  type: http
-  seq: 12
-http:
-  method: DELETE
-  url: '{{base_url}}/api/auth/profile/{{user_id}}'
-  auth: inherit
-
-docs: |-
-  ## Delete User Account
-    
-    Delete a user account. Users can delete their own account, admins can delete any user.
-    
-    **Method:** DELETE
-    
-    **Endpoint:** /api/auth/profile (self) or /api/auth/profile/:id (admin)
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Status Codes:**
-    - 200: Success
-    - 400: Cannot delete the last admin
-    - 403: Not an admin (when trying to delete another user)
-    - 404: User not found

bruno/user/admin/List Users.yml

@@ -1,45 +0,0 @@
-info:
-  name: List Users
-  type: http
-  seq: 5
-http:
-  method: GET
-  url: '{{base_url}}/api/auth/users'
-  auth: inherit
-  body:
-    type: none
-
-docs: |-
-  ## List Users
-    
-    Retrieves a list of all users with complete user information.
-    
-    **Method:** GET
-    
-    **Endpoint:** /api/auth/users
-    
-    **Authentication:** Required (Admin only)
-    
-    **Response:** Array of user objects with complete information:
-    - `id` (string): User ID (UUID)
-    - `email` (string): Email address
-    - `username` (string): Username
-    - `first_name` (string): First name (empty if not set)
-    - `last_name` (string): Last name (empty if not set)
-    - `role` (string): User role ("user" or "admin")
-    - `theme` (string): Theme preference (empty if default)
-    - `max_devices` (integer): Maximum number of devices allowed
-    - `device_count` (integer): Current number of registered devices
-    - `created_at` (string): Creation timestamp (ISO 8601)
-    - `updated_at` (string): Last update timestamp (ISO 8601)
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 403: Forbidden (admin access required)
-    
-    **Features:**
-    - Admin-only endpoint with complete user information
-    - Returns first_name, last_name, role, theme fields
-    - Includes device limits and current device count
-    - Useful for user management interfaces

bruno/user/admin/Register Admin User.yml

@@ -1,64 +0,0 @@
-info:
-  name: Register Admin User
-  type: http
-  seq: 4
-http:
-  method: POST
-  url: '{{base_url}}/api/auth/register'
-  auth: inherit
-  body:
-    type: json
-    data: |-
-      {
-        "email": "admin@example.com",
-        "username": "admin",
-        "password": "Admin@Pass123!",
-        "first_name": "Admin",
-        "last_name": "User",
-        "role": "admin"
-      }
-
-docs: |-
-  ## Register Admin User
-    
-    Creates a new admin user account with role-based restrictions.
-    
-    **Method:** POST
-    
-    **Endpoint:** /api/auth/register
-    
-     **Request Body:**
-     - `email` (string): Email address
-     - `username` (string): Username
-     - `password` (string): Password
-     - `first_name` (string, optional): First name
-     - `last_name` (string, optional): Last name
-     - `role` (string): Must be "admin"
-    
-    **Response:**
-     - `token` (string): JWT token with admin role
-      - `user` (object): User details
-         - `id` (string): User ID
-         - `email` (string): Email
-         - `username` (string): Username
-     - `theme` (string): User theme preference
-         - `first_name` (string, optional): First name
-         - `last_name` (string, optional): Last name
-         - `role` (string): User role ("admin")
-    
-    **Status Codes:**
-     - 201: Created
-     - 400: Invalid input data
-     - 403: Forbidden - admin creation restrictions apply
-     - 409: User exists
-    
-    **Role Restrictions:**
-     - **First User**: Anyone can create first admin (auto-assigned)
-     - **Existing Admins Present**: Only authenticated admins can create new admin accounts
-     - **Unauthenticated Users**: Cannot create admin accounts if any admin exists
-     - **Security**: Requires admin authentication for subsequent admin creation
-    
-    **Usage Notes:**
-     - Use this request only when specifically creating admin accounts
-     - For regular user creation, use "Register User" request
-     - Admin token will have elevated privileges for administrative operations

bruno/user/admin/Reset User Password.yml

@@ -1,12 +0,0 @@
-info:
-  name: Reset User Password
-  type: http
-  seq: 11
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/password/{{user_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"new_password\": \"NewSecurePassword123!\",\n  \"confirm_password\": \"NewSecurePassword123!\"\n}"
-docs: "## Admin Reset User Password\n  \n  Admin-only endpoint to reset another user's password.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/auth/password/:id\n  \n  **Authentication:** Required (Admin Bearer token)\n  \n  **Request Body:**\n  - `new_password` (string, required): New password\n  - `confirm_password` (string, required): Must match new_password\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Passwords do not match or invalid format\n  - 403: Not an admin\n  - 404: User not found"

bruno/user/admin/Update User Max Devices.yml

@@ -1,27 +0,0 @@
-info:
-  name: Update User Max Devices
-  type: http
-  seq: 6
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/users/{{user_id}}/max-devices'
-  auth: inherit
-
-docs: |-
-  ## Update User Max Devices (Admin)
-  
-    Updates the maximum number of devices a user can register.
-  
-    **Method:** PUT
-  
-    **Endpoint:** /api/auth/users/:id/max-devices
-  
-    **Authentication:** Required (Admin only)
-  
-    **URL Parameters:**
-    - `id` (string): User ID (UUID)
-  
-    **Request Body:**
-    ```json
-    {
-      "max_devices": 10

bruno/user/admin/Update User.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update User
-  type: http
-  seq: 10
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/profile/{{user_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"username\": \"newusername\",\n  \"email\": \"newemail@example.com\",\n  \"role\": \"admin\"\n}"
-docs: "## Admin Update User\n  \n  Admin-only endpoint to update another user's profile.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/auth/profile/:id\n  \n  **Authentication:** Required (Admin Bearer token)\n  \n  **Request Body:**\n  - `username` (string, optional): New username\n  - `email` (string, optional): New email\n  - `first_name` (string, optional): First name\n  - `last_name` (string, optional): Last name\n  - `theme` (string, optional): Theme preference\n  - `role` (string, optional): Role (\"user\" or \"admin\") - admin only\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid role or cannot demote last admin\n  - 403: Not an admin\n  - 404: User not found\n  - 409: Username or email already taken"

bruno/user/auth/Login User.yml

@@ -1,77 +0,0 @@
-info:
-  name: Login User
-  type: http
-  seq: 1
-
-http:
-  method: POST
-  url: "{{base_url}}/api/auth/login"
-  body:
-    type: json
-    data: |-
-      {
-        "login": "testuser@tests.bookhoard.internal",
-        "password": "Test@Pass123!"
-      }
-
-runtime:
-  scripts:
-    - type: after-response
-      code: |-
-        function onResponse(res) {
-          try {
-            const responseBody = res.getBody();
-            const token = responseBody.access_token;
-            const refreshToken = responseBody.refresh_token;
-
-            if (token) {
-              bru.setEnvVar("token", token, { persist: true });
-              console.log("Access token saved:", token);
-            }
-
-            if (refreshToken) {
-              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
-              console.log("Refresh token saved:", refreshToken);
-            }
-
-            if (!token && !refreshToken) {
-              console.log("No tokens found in response.");
-            }
-          } catch (error) {
-            console.error("Error in post-response script:", error.message);
-          }
-        }
-        onResponse(res);
-
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-docs: |-
-  ## Login User
-
-    Authenticates a user with email/username and password.
-
-    **Method:** POST
-
-    **Endpoint:** /api/auth/login
-
-    **Request Body:**
-    - `login` (string): Email or username
-    - `password` (string): Password
-
-    **Response:**
-    - `token` (string): JWT token
-     - `user` (object): User details
-       - `id` (string): User ID
-       - `email` (string): Email
-       - `username` (string): Username
-       - `theme` (string): User theme preference
-       - `first_name` (string): First name
-       - `last_name` (string): Last name
-
-    **Status Codes:**
-    - 200: Success
-    - 401: Invalid credentials

bruno/user/auth/Logout User.yml

@@ -1,43 +0,0 @@
-info:
-  name: Logout User
-  type: http
-  seq: 3
-http:
-  method: POST
-  url: '{{base_url}}/api/auth/logout'
-  auth: inherit
-  body:
-    type: json
-    data: |-
-      {
-        "refresh_token": "{{refresh_token}}"
-      }
-  headers:
-  - key: Content-Type
-    value: application/json
-
-docs: |-
-  ## Logout User
-  
-    Logs out the user by revoking their refresh token. If no refresh token is provided, the request succeeds but no token is revoked.
-  
-    **Method:** POST
-  
-    **Endpoint:** /api/auth/logout
-  
-    **Authentication:** Bearer token (optional)
-  
-    **Request Body:**
-    - `refresh_token` (string, optional): Refresh token to revoke
-  
-    **Response:**
-    - `message` (string): Success message
-  
-    **Status Codes:**
-    - 200: Success - user logged out (token revoked if provided)
-    - 401: Unauthorized
-  
-    **Example Response:**
-    ```json
-    {
-      "message": "logged out successfully"

bruno/user/auth/Refresh Token.yml

@@ -1,83 +0,0 @@
-info:
-  name: Refresh Access Token
-  type: http
-  seq: 4
-
-http:
-  method: POST
-  url: "{{base_url}}/api/auth/refresh"
-  headers:
-    - name: ""
-      value: application/json
-  body:
-    type: json
-    data: |-
-      {
-        "refresh_token": "{{refresh_token}}"
-      }
-  auth: inherit
-
-runtime:
-  scripts:
-    - type: after-response
-      code: |-
-        function onResponse(res) {
-          try {
-            const responseBody = res.getBody();
-            const token = responseBody.access_token;
-            const refreshToken = responseBody.refresh_token;
-
-            if (token) {
-              bru.setEnvVar("token", token, { persist: true });
-              console.log("Access token saved:", token);
-            }
-
-            if (refreshToken) {
-              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
-              console.log("Refresh token saved:", refreshToken);
-            }
-
-            if (!token && !refreshToken) {
-              console.log("No tokens found in response.");
-            }
-          } catch (error) {
-            console.error("Error in post-response script:", error.message);
-          }
-        }
-        onResponse(res);
-
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-docs: |-
-  ## Refresh Access Token
-
-    Refreshes an access token using a valid refresh token. Returns a new access token with 1-hour expiration.
-
-    **Method:** POST
-
-    **Endpoint:** /api/auth/refresh
-
-    **Authentication:** Not required (refresh token is in request body)
-
-    **Request Body:**
-    - `refresh_token` (string): Valid refresh token UUID
-
-    **Response:**
-    - `access_token` (string): New JWT access token (1 hour expiration)
-    - `token_type` (string): Token type (usually "Bearer")
-    - `expires_in` (number): Token lifetime in seconds (3600)
-
-    **Status Codes:**
-    - 200: Success - new access token generated
-    - 401: Unauthorized - invalid or expired refresh token
-
-    **Example Response (Success):**
-    ```json
-    {
-      "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
-      "token_type": "Bearer",
-      "expires_in": 3600

bruno/user/auth/Register User.yml

@@ -1,98 +0,0 @@
-info:
-  name: Register User
-  type: http
-  seq: 2
-
-http:
-  method: POST
-  url: "{{base_url}}/api/auth/register"
-  body:
-    type: json
-    data: |-
-      {
-        "username": "testuser",
-        "email": "testuser@tests.bookhoard.internal",
-        "password": "Test@Pass123!",
-        "first_name": "Test",
-        "last_name": "User"
-      }
-  auth: inherit
-
-runtime:
-  scripts:
-    - type: after-response
-      code: |-
-        function onResponse(res) {
-          try {
-            const responseBody = res.getBody();
-            const token = responseBody.access_token;
-            const refreshToken = responseBody.refresh_token;
-
-            if (token) {
-              bru.setEnvVar("token", token, { persist: true });
-              console.log("Access token saved:", token);
-            }
-
-            if (refreshToken) {
-              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
-              console.log("Refresh token saved:", refreshToken);
-            }
-
-            if (!token && !refreshToken) {
-              console.log("No tokens found in response.");
-            }
-          } catch (error) {
-            console.error("Error in post-response script:", error.message);
-          }
-        }
-        onResponse(res);
-
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-docs: |-
-  ## Register User
-    
-    Creates a new user account with role-based restrictions.
-    
-    **Method:** POST
-    
-    **Endpoint:** /api/auth/register
-    
-     **Request Body:**
-     - `email` (string): Email address
-     - `username` (string): Username
-     - `password` (string): Password
-     - `first_name` (string, optional): First name
-     - `last_name` (string, optional): Last name
-     - `role` (string): User role ("user" or "admin")
-    
-    **Response:**
-     - `token` (string): JWT token
-      - `user` (object): User details
-         - `id` (string): User ID
-         - `email` (string): Email
-         - `username` (string): Username
-     - `theme` (string): User theme preference
-         - `first_name` (string, optional): First name
-         - `last_name` (string, optional): Last name
-         - `role` (string): User role ("user" or "admin")
-    
-    **Status Codes:**
-     - 201: Created
-     - 400: Invalid input data
-     - 403: Forbidden - role-based restrictions apply
-     - 409: User exists
-    
-    **Role Restrictions:**
-     - **First User**: Automatically gets admin role regardless of request
-     - **Existing Admins Present**: Only authenticated admins can create new admin accounts
-     - **No Admins Yet**: Anyone can create first admin (auto-assigned)
-     - **Regular User Creation**: Anyone can create regular user accounts
-     - **Unauthenticated Users**: Can only create first admin, not subsequent admins
-    
-    **Examples:**
-     - First admin creation: `{"email": "admin@example.com", "username": "admin", "password": "password123", "role": "admin"

bruno/user/profile/Get Profile.yml

@@ -1,33 +0,0 @@
-info:
-  name: Get Profile
-  type: http
-  seq: 1
-http:
-  method: GET
-  url: '{{base_url}}/api/auth/profile'
-  auth: inherit
-  body:
-    type: none
-
-docs: |-
-  ## Get User Profile
-    
-    Retrieves the authenticated user's profile.
-    
-    **Method:** GET
-    
-    **Endpoint:** /api/auth/profile
-    
-    **Authentication:** Required
-    
-     **Response:**
-     - `id` (string): User ID
-     - `email` (string): Email
-     - `username` (string): Username
-     - `theme` (string): User theme preference
-     - `first_name` (string, optional): First name
-     - `last_name` (string, optional): Last name
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized

bruno/user/profile/Update Password.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update Password
-  type: http
-  seq: 3
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/password'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"current_password\": \"password123\",\n    \"new_password\": \"newpassword123\",\n    \"confirm_password\": \"newpassword123\""
-docs: "## Update Password\n  \n  Updates the authenticated user's password.\n  \n  **Method:** PUT\n  \n   **Endpoint:** /api/auth/password\n  \n  **Authentication:** Required\n  \n  **Request Body:**\n  - `current_password` (string, required): Current password for verification\n  - `new_password` (string, required): New password (minimum 6 characters)\n  - `confirm_password` (string, required): Confirmation of new password\n  \n  **Response:**\n  - `message` (string): Success message\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Password validation failed\n  - 401: Current password incorrect\n  - 401: Unauthorized"

bruno/user/profile/Update Profile.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update Profile
-  type: http
-  seq: 4
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/profile'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"username\": \"updateduser\",\n  \"email\": \"updated@tests.bookhoard.internal\",\n  \"first_name\": \"Updated\",\n  \"last_name\": \"User\",\n  \"theme\": \"dracula\"\n}"
-docs: "## Update User Profile\n  \n  Updates the authenticated user's profile information.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/auth/profile\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Request Body:**\n  - `username` (string, optional): New username (must be unique)\n  - `email` (string, optional): New email address (must be unique)\n  - `first_name` (string, optional): First name\n  - `last_name` (string, optional): Last name\n  - `theme` (string, optional): Theme preference\n  \n  **Response:**\n  - `message` (string): Success message\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid request\n  - 401: Unauthorized\n  - 409: Username or email already taken"

bruno/user/profile/Update Theme.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update Theme
-  type: http
-  seq: 5
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/theme'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"theme\": \"dracula\"\n}"
-docs: "## Update Theme\n  \n  Fast theme switching for the application UI.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/auth/theme\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Request Body:**\n  - `theme` (string, required): Theme name\n  \n  **Response:**\n  - `message` (string): Success message\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid theme\n  - 401: Unauthorized"