feat: support multiple device authentication methods

- Bearer token in Authorization header (KOReader, API clients)
- URL path parameter (Kobo sync: /api/sync/kobo/:token/...)
- Query parameter (OPDS: ?token=...)
- Update Kobo sync routes to use token in path
- Add authentication method documentation to OPDS routes

internal/router/opds.go

@@ -1,9 +1,17 @@
 package router
 
 // Register OPDS routes with device authentication
-// Devices must use their devices.auth_token (generated during device registration/approval)
-// Kobo devices store this token for both sync and OPDS catalog access
+//
+// Authentication Methods:
+// - Kobo devices: URL path parameter (e.g., /opds/devices/kobo-clara/catalog?token=dev_abc...)
+//   (Token stored in device for use in stock firmware sync)
+//
+// - KOReader devices: Bearer token in Authorization header (e.g., Authorization: Bearer dev_xyz...)
+//   (Token configured in device settings, passed to plugins)
+//
+// Middleware supports both methods (see device_auth.go)
 // Returns 401 Unauthorized if device token is missing, invalid, or device sync is disabled
+
 func registerOPDSRoutes(cfg *Config) {
 	e := cfg.Echo
 

internal/router/sync.go

@@ -29,8 +29,10 @@ func registerSyncRoutes(cfg *Config) {
 	koreaderSync.POST("/bookmarks", cfg.DeviceAuthMiddleware.Authenticate(cfg.KOReaderHandler.SyncBookmarks))
 
 	// Kobo sync routes (device authentication required)
+	// Kobo devices use URL path: /api/sync/kobo/{token}/markup
+	// API clients can use Authorization header: Authorization: Bearer {token}
 	koboHandler := handlers.NewKoboHandler(cfg.Queries, cfg.ConnManager)
-	koboSync := e.Group("/api/sync/kobo")
+	koboSync := e.Group("/api/sync/kobo/:token")
 	koboSync.POST("/markup", cfg.DeviceAuthMiddleware.Authenticate(koboHandler.Markup))
 	koboSync.POST("/bookmark", cfg.DeviceAuthMiddleware.Authenticate(koboHandler.Bookmark))
 	koboSync.POST("/v1/analytics/gettests", cfg.DeviceAuthMiddleware.Authenticate(koboHandler.AnalyticsGettests))