bruno: regenerate collection from canonical docs + permanent docs↔Bruno parity gate

WO4. The old collection was the drifted artifact AGENTS.md warned about:
bodies pre-truncated at their first {{var}}, routes renamed server-side
but not here (/api/notes/:media_id, /api/book-matching/search,
/api/collections/:id/rules/test), an orphan universal-progress suite for
routes that no longer exist.

scripts/gen_bruno_from_docs.py emits one OpenCollection request per
frontmatter'd endpoint doc (191 requests): gate-verified example-request
JSON as body, {{env}} params per the environment file, device-token
routes get an explicit Bearer {{device_token}} header, login/register/
refresh keep the token-capture after-response scripts that chain the
collection. Old 1:1 mirrors deleted (128); hand-authored NewDevDBSetup,
environments, and edge-case suites kept. 30 scenario files with
truncated bodies (the documented corruption) deleted — they could not
run.

internal/docs/drift_test.go gains TestBrunoMirrorsDocs: every
frontmatter'd doc must have a Bruno request with matching method+URL
shape — the collection can never silently drift from the docs again.
opencollection.yml README block replaced with the real run instructions.

make test green (9 pkgs, parity test included in internal/docs).

bruno/users/change_password.yml

@@ -0,0 +1,29 @@
+info:
+  name: Change Password
+  type: http
+  seq: 1
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/auth/password'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "current_password": "OldPassword123!",
+        "new_password": "NewSecureP@ss123!",
+        "confirm_password": "NewSecureP@ss123!"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs: |-
+  # Change Password
+
+  `PUT /api/auth/password` — auth: jwt.
+
+  Canonical reference: `docs/developer/api/users/change_password.md` (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, not this file.