feat: support multiple device authentication methods

- Bearer token in Authorization header (KOReader, API clients)
- URL path parameter (Kobo sync: /api/sync/kobo/:token/...)
- Query parameter (OPDS: ?token=...)
- Update Kobo sync routes to use token in path
- Add authentication method documentation to OPDS routes

internal/router/opds.go

@@ -1,9 +1,17 @@
 package router
 
 // Register OPDS routes with device authentication
-// Devices must use their devices.auth_token (generated during device registration/approval)
-// Kobo devices store this token for both sync and OPDS catalog access
+//
+// Authentication Methods:
+// - Kobo devices: URL path parameter (e.g., /opds/devices/kobo-clara/catalog?token=dev_abc...)
+//   (Token stored in device for use in stock firmware sync)
+//
+// - KOReader devices: Bearer token in Authorization header (e.g., Authorization: Bearer dev_xyz...)
+//   (Token configured in device settings, passed to plugins)
+//
+// Middleware supports both methods (see device_auth.go)
 // Returns 401 Unauthorized if device token is missing, invalid, or device sync is disabled
+
 func registerOPDSRoutes(cfg *Config) {
 	e := cfg.Echo