docs(auth,users,devices,progress,matching): Beam batch 8 — WO5 backfill complete

14 endpoints backfilled: devices pending/approve/reject; users
password/profile/profile-delete self-service (admin variants in prose);
admin list_users + update_user_max_devices; progress history; book
matching; new password-rules doc.

Gate fix: authLabel missed JWT middleware written inline as
createJWTMiddleware(cfg) (uppercase 'JWT') — reported auth 'none' for
/api/auth self-service routes and would have for any wrapper-inlined
group. Labeled 'JWTMiddleware' + fallthrough 'jwt' case.

Claude registry: 12 entries. Drift fixed by gate: list_users on-device —
handler returns raw []database.Users (bare array, full model incl.
password_hash — real leak the API emits; pinned + documented; earlier
draft had invented {users,total,limit,offset} wrapper). max-devices
response is {message} only. books/match is GET /api/books/match
{matches, action}. progress history sessions = ReadingHistory rows
(pgtype fields). make test 9/9.

docs/developer/api/progress/get_progress_history.md

@@ -1,3 +1,11 @@
+---
+method: GET
+path: /api/progress/:id/history
+auth: jwt
+area: progress
+---
+<!-- source: internal/handlers/progress.go:34 Handler.GetProgressHistory -->
+
 # Get Progress History
 
 Get historical reading progress data for a media item.
@@ -33,31 +41,11 @@ Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
 
 ## Response (200 OK)
 
-```json
+```json example-response
 {
-  "history": [
-    {
-      "media_item_id": "uuid",
-      "percentage": 75.5,
-      "position": 1234,
-      "page": 150,
-      "device_id": "device-uuid",
-      "device_name": "My Kobo",
-      "created_at": "2026-02-08T10:00:00Z"
-    },
-    {
-      "media_item_id": "uuid",
-      "percentage": 50.0,
-      "position": 800,
-      "page": 100,
-      "device_id": "device-uuid",
-      "device_name": "My Kobo",
-      "created_at": "2026-02-07T15:00:00Z"
-    }
-  ],
-  "total": 45,
-  "limit": 20,
-  "offset": 0
+  "count": null,
+  "media_item_id": null,
+  "sessions": null
 }
 ```