docs(auth,devices): Beam WO5 batch 3 — 15 endpoints backfilled, registry pinned

Beam backfilled auth core (login/register/refresh/logout/profile) and devices
core (list/update/delete/shelf CRUD/sidecar/register flow) with frontmatter,
provenance, and labeled examples. All claimed shapes verified against
handlers: AuthResponse {access_token, refresh_token omitempty, token_type,
expires_in, user}, update device {device_updated, device}, shelf wrappers,
DeviceAuthStatusResponse.

Claude registry verification: 15 entries pinned by type (LoginRequest,
RegisterRequest, AuthResponse, RefreshTokenRequest/Response, UserProfile,
DeviceListResponse, DeviceUpdateRequest, AddToShelfRequest, SidecarConfig,
DeviceRegistrationRequest/Response, DeviceAuthStatusRequest/Response).
Removed revoke_device.md — name-only duplicate of delete_device.md (same
DELETE /api/devices/:id route; was the last audit-orphan doc).

Gate catches this round (subtle Go serialization facts, now pinned in docs):
- uuid.UUID arrays never serialize as omitted: register/status response
  ALWAYS carries device_id (all-zeros while pending) despite omitempty
- update device request binds device_name, not name
- register response includes device_id alongside registration_id
- list devices response is a {devices, total} wrapper

internal/docs/schema.go

@@ -372,4 +372,71 @@ var Schemas = map[string]Schema{
 	"DELETE /api/queue/devices/:device_id/clear": {
 		Response: json.RawMessage(`{"message": ""}`),
 	},
+
+	// --- Beam batch 3: auth core + devices core ---
+	"POST /api/auth/login": {
+		Request:  handlers.LoginRequest{},
+		Response: handlers.AuthResponse{},
+	},
+	"POST /api/auth/register": {
+		Request:  handlers.RegisterRequest{},
+		Response: handlers.AuthResponse{},
+	},
+	"POST /api/auth/refresh": {
+		Request:  handlers.RefreshTokenRequest{},
+		Response: handlers.RefreshTokenResponse{},
+	},
+	"POST /api/auth/logout": {
+		Response: json.RawMessage(`{"message": ""}`),
+	},
+	"GET /api/auth/profile": {
+		Response: handlers.UserProfile{},
+	},
+	"GET /api/devices": {
+		Response: handlers.DeviceListResponse{},
+	},
+	"PUT /api/devices/:id": {
+		Request: handlers.DeviceUpdateRequest{},
+		Response: json.RawMessage(`{
+			"device_updated": false,
+			"device": {
+				"id": "", "device_name": "", "device_type": "",
+				"last_sync": null, "last_seen": null,
+				"sync_enabled": false, "auto_sync": false,
+				"sync_frequency_minutes": 0, "created_at": "",
+				"device_metadata": null, "auth_token": ""
+			}
+		}`),
+	},
+	"DELETE /api/devices/:id": {},
+	"GET /api/devices/:id/shelves": {
+		Response: json.RawMessage(`{
+			"status": "", "device_id": "", "shelf_name": "",
+			"books": [{}], "total": 0
+		}`),
+	},
+	"POST /api/devices/:id/shelves": {
+		Request: handlers.AddToShelfRequest{},
+		Response: json.RawMessage(`{
+			"status": "", "added_count": 0,
+			"shelf_name": "", "total_count": 0
+		}`),
+	},
+	"DELETE /api/devices/:id/shelves": {
+		Response: json.RawMessage(`{"status": "", "message": ""}`),
+	},
+	"DELETE /api/devices/:id/shelves/clear": {
+		Response: json.RawMessage(`{"status": "", "message": ""}`),
+	},
+	"GET /api/devices/:id/sidecar": {
+		Response: handlers.SidecarConfig{},
+	},
+	"POST /api/devices/register": {
+		Request:  handlers.DeviceRegistrationRequest{},
+		Response: handlers.DeviceRegistrationResponse{},
+	},
+	"POST /api/devices/register/status": {
+		Request:  handlers.DeviceAuthStatusRequest{},
+		Response: handlers.DeviceAuthStatusResponse{},
+	},
 }