bruno: regenerate collection from canonical docs + permanent docs↔Bruno parity gate

WO4. The old collection was the drifted artifact AGENTS.md warned about:
bodies pre-truncated at their first {{var}}, routes renamed server-side
but not here (/api/notes/:media_id, /api/book-matching/search,
/api/collections/:id/rules/test), an orphan universal-progress suite for
routes that no longer exist.

scripts/gen_bruno_from_docs.py emits one OpenCollection request per
frontmatter'd endpoint doc (191 requests): gate-verified example-request
JSON as body, {{env}} params per the environment file, device-token
routes get an explicit Bearer {{device_token}} header, login/register/
refresh keep the token-capture after-response scripts that chain the
collection. Old 1:1 mirrors deleted (128); hand-authored NewDevDBSetup,
environments, and edge-case suites kept. 30 scenario files with
truncated bodies (the documented corruption) deleted — they could not
run.

internal/docs/drift_test.go gains TestBrunoMirrorsDocs: every
frontmatter'd doc must have a Bruno request with matching method+URL
shape — the collection can never silently drift from the docs again.
opencollection.yml README block replaced with the real run instructions.

make test green (9 pkgs, parity test included in internal/docs).

bruno/user/admin/Delete User.yml

@@ -1,25 +0,0 @@
-info:
-  name: Delete User
-  type: http
-  seq: 12
-http:
-  method: DELETE
-  url: '{{base_url}}/api/auth/profile/{{user_id}}'
-  auth: inherit
-
-docs: |-
-  ## Delete User Account
-    
-    Delete a user account. Users can delete their own account, admins can delete any user.
-    
-    **Method:** DELETE
-    
-    **Endpoint:** /api/auth/profile (self) or /api/auth/profile/:id (admin)
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Status Codes:**
-    - 200: Success
-    - 400: Cannot delete the last admin
-    - 403: Not an admin (when trying to delete another user)
-    - 404: User not found

bruno/user/admin/List Users.yml

@@ -1,45 +0,0 @@
-info:
-  name: List Users
-  type: http
-  seq: 5
-http:
-  method: GET
-  url: '{{base_url}}/api/auth/users'
-  auth: inherit
-  body:
-    type: none
-
-docs: |-
-  ## List Users
-    
-    Retrieves a list of all users with complete user information.
-    
-    **Method:** GET
-    
-    **Endpoint:** /api/auth/users
-    
-    **Authentication:** Required (Admin only)
-    
-    **Response:** Array of user objects with complete information:
-    - `id` (string): User ID (UUID)
-    - `email` (string): Email address
-    - `username` (string): Username
-    - `first_name` (string): First name (empty if not set)
-    - `last_name` (string): Last name (empty if not set)
-    - `role` (string): User role ("user" or "admin")
-    - `theme` (string): Theme preference (empty if default)
-    - `max_devices` (integer): Maximum number of devices allowed
-    - `device_count` (integer): Current number of registered devices
-    - `created_at` (string): Creation timestamp (ISO 8601)
-    - `updated_at` (string): Last update timestamp (ISO 8601)
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 403: Forbidden (admin access required)
-    
-    **Features:**
-    - Admin-only endpoint with complete user information
-    - Returns first_name, last_name, role, theme fields
-    - Includes device limits and current device count
-    - Useful for user management interfaces

bruno/user/admin/Register Admin User.yml

@@ -1,64 +0,0 @@
-info:
-  name: Register Admin User
-  type: http
-  seq: 4
-http:
-  method: POST
-  url: '{{base_url}}/api/auth/register'
-  auth: inherit
-  body:
-    type: json
-    data: |-
-      {
-        "email": "admin@example.com",
-        "username": "admin",
-        "password": "Admin@Pass123!",
-        "first_name": "Admin",
-        "last_name": "User",
-        "role": "admin"
-      }
-
-docs: |-
-  ## Register Admin User
-    
-    Creates a new admin user account with role-based restrictions.
-    
-    **Method:** POST
-    
-    **Endpoint:** /api/auth/register
-    
-     **Request Body:**
-     - `email` (string): Email address
-     - `username` (string): Username
-     - `password` (string): Password
-     - `first_name` (string, optional): First name
-     - `last_name` (string, optional): Last name
-     - `role` (string): Must be "admin"
-    
-    **Response:**
-     - `token` (string): JWT token with admin role
-      - `user` (object): User details
-         - `id` (string): User ID
-         - `email` (string): Email
-         - `username` (string): Username
-     - `theme` (string): User theme preference
-         - `first_name` (string, optional): First name
-         - `last_name` (string, optional): Last name
-         - `role` (string): User role ("admin")
-    
-    **Status Codes:**
-     - 201: Created
-     - 400: Invalid input data
-     - 403: Forbidden - admin creation restrictions apply
-     - 409: User exists
-    
-    **Role Restrictions:**
-     - **First User**: Anyone can create first admin (auto-assigned)
-     - **Existing Admins Present**: Only authenticated admins can create new admin accounts
-     - **Unauthenticated Users**: Cannot create admin accounts if any admin exists
-     - **Security**: Requires admin authentication for subsequent admin creation
-    
-    **Usage Notes:**
-     - Use this request only when specifically creating admin accounts
-     - For regular user creation, use "Register User" request
-     - Admin token will have elevated privileges for administrative operations

bruno/user/admin/Reset User Password.yml

@@ -1,12 +0,0 @@
-info:
-  name: Reset User Password
-  type: http
-  seq: 11
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/password/{{user_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"new_password\": \"NewSecurePassword123!\",\n  \"confirm_password\": \"NewSecurePassword123!\"\n}"
-docs: "## Admin Reset User Password\n  \n  Admin-only endpoint to reset another user's password.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/auth/password/:id\n  \n  **Authentication:** Required (Admin Bearer token)\n  \n  **Request Body:**\n  - `new_password` (string, required): New password\n  - `confirm_password` (string, required): Must match new_password\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Passwords do not match or invalid format\n  - 403: Not an admin\n  - 404: User not found"

bruno/user/admin/Update User Max Devices.yml

@@ -1,27 +0,0 @@
-info:
-  name: Update User Max Devices
-  type: http
-  seq: 6
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/users/{{user_id}}/max-devices'
-  auth: inherit
-
-docs: |-
-  ## Update User Max Devices (Admin)
-  
-    Updates the maximum number of devices a user can register.
-  
-    **Method:** PUT
-  
-    **Endpoint:** /api/auth/users/:id/max-devices
-  
-    **Authentication:** Required (Admin only)
-  
-    **URL Parameters:**
-    - `id` (string): User ID (UUID)
-  
-    **Request Body:**
-    ```json
-    {
-      "max_devices": 10

bruno/user/admin/Update User.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update User
-  type: http
-  seq: 10
-http:
-  method: PUT
-  url: '{{base_url}}/api/auth/profile/{{user_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"username\": \"newusername\",\n  \"email\": \"newemail@example.com\",\n  \"role\": \"admin\"\n}"
-docs: "## Admin Update User\n  \n  Admin-only endpoint to update another user's profile.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/auth/profile/:id\n  \n  **Authentication:** Required (Admin Bearer token)\n  \n  **Request Body:**\n  - `username` (string, optional): New username\n  - `email` (string, optional): New email\n  - `first_name` (string, optional): First name\n  - `last_name` (string, optional): Last name\n  - `theme` (string, optional): Theme preference\n  - `role` (string, optional): Role (\"user\" or \"admin\") - admin only\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid role or cannot demote last admin\n  - 403: Not an admin\n  - 404: User not found\n  - 409: Username or email already taken"