fix(opds): Require device authentication for OPDS catalog endpoints

- Apply DeviceAuthMiddleware.Authenticate to /opds/devices/* routes
- OPDS now uses same authentication model as sync API (devices.auth_token)
- Removes security vulnerability allowing unauthorized device enumeration
- Update test expectations to require 401 for unauthenticated requests
- Fix query parameter name from 'query' to 'q' in search endpoints
- Update router comments to clarify authentication requirements

internal/router/opds.go

@@ -1,11 +1,15 @@
 package router
 
+// Register OPDS routes with device authentication
+// Devices must use their devices.auth_token (generated during device registration/approval)
+// Kobo devices store this token for both sync and OPDS catalog access
+// Returns 401 Unauthorized if device token is missing, invalid, or device sync is disabled
 func registerOPDSRoutes(cfg *Config) {
 	e := cfg.Echo
 
-	// OPDS routes (public - device authentication optional)
-	// Note: OPDSHandler implements its own device authentication
+	// Require device authentication for all OPDS endpoints
 	opds := e.Group("/opds/devices")
+	opds.Use(cfg.DeviceAuthMiddleware.Authenticate)
 	opds.GET("/:deviceId/catalog", cfg.OPDSHandler.GetDeviceCatalog)
 	opds.GET("/:deviceId/search", cfg.OPDSHandler.SearchDeviceCatalog)
 	opds.GET("/:deviceId/nav", cfg.OPDSHandler.GetDeviceNavigation)