docs(auth,users,devices,progress,matching): Beam batch 8 — WO5 backfill complete

14 endpoints backfilled: devices pending/approve/reject; users
password/profile/profile-delete self-service (admin variants in prose);
admin list_users + update_user_max_devices; progress history; book
matching; new password-rules doc.

Gate fix: authLabel missed JWT middleware written inline as
createJWTMiddleware(cfg) (uppercase 'JWT') — reported auth 'none' for
/api/auth self-service routes and would have for any wrapper-inlined
group. Labeled 'JWTMiddleware' + fallthrough 'jwt' case.

Claude registry: 12 entries. Drift fixed by gate: list_users on-device —
handler returns raw []database.Users (bare array, full model incl.
password_hash — real leak the API emits; pinned + documented; earlier
draft had invented {users,total,limit,offset} wrapper). max-devices
response is {message} only. books/match is GET /api/books/match
{matches, action}. progress history sessions = ReadingHistory rows
(pgtype fields). make test 9/9.

internal/docs/drift_test.go

@@ -140,6 +140,10 @@ func authLabel(chain []string) string {
 		return "device-token"
 	case has("createOptionalAuthMiddleware"):
 		return "optional-jwt"
+	case has("JWTMiddleware"):
+		// Wrapper-inlined forms like createJWTMiddleware(cfg) carry uppercase
+		// JWT; bare jwtMiddleware carries lowercase. Match both.
+		fallthrough
 	case has("jwt"):
 		return "jwt"
 	default: