feat(docs): drift gate — docs frontmatter validated against real routes

Every API doc that declares frontmatter (method/path/auth/area) is now
checked by a unit test against three sources of truth:

1. Route registration: internal/router/*.go is parsed the way echo resolves
   it (group prefixes concatenate; scanner.go's parameterized groups seeded).
   Doc paths that no longer exist fail. (This is the check that would have
   caught the /api/api/admin/hash-conflicts split.)
2. Auth: frontmatter auth label must match the middleware chain
   (none|jwt|jwt+admin|device-token|optional-jwt).
3. Shapes: internal/docs/schema.go registry — example-request decoded with
   unknown fields DISALLOWED (typo guard), required-by-validate fields must
   appear (staleness guard), example-response top-level key set compared
   both directions against the marshaled handler type (or a RawMessage pin
   for hand-built map responses).

Five collections docs are the pilots with real handler shapes; notable
corrections they pin: update returns 201 (not 200), list excludes smart
collections unless include_auto=true, rule priority is 1-10 higher-wins
(docs claimed 1=highest), created_at is Go time.String() not RFC3339,
hide_finished/show_up_next toggles documented. CollectionResponse hoisted
out of GetCollections/GetBookCollections as CollectionSummary /
BookCollectionSummary so the registry can pin real types.

The gate fails on missing registry entries by design — that is the
maintenance contract. Known pre-existing (not this commit): vet copy-lock
warnings in media.go.

docs/developer/api/collections/delete_collection.md

@@ -1,27 +1,28 @@
+---
+method: DELETE
+path: /api/collections/:id
+auth: jwt
+area: collections
+---
+<!-- source: internal/handlers/collections.go:464 CollectionHandler.DeleteCollection -->
+
 # Delete Collection
 
-Delete a collection. Books are NOT deleted.
+Deletes a collection. Membership rows go with it; the books themselves are
+untouched.
 
-**Endpoint**: `DELETE /api/collections/{id}`
-**Auth**: Required
-**Content-Type**: `application/json`
+Success is **204 No Content** — there is no response body. (htmx requests
+receive a small HTML redirect snippet instead; that behavior is web-internal.)
 
-## Path Parameters
+## Example request
 
-| Parameter | Type          | Required | Description     |
-| --------- | ------------- | -------- | --------------- |
-| id        | string (UUID) | Yes      | Collection UUID |
+```text
+DELETE /api/collections/550e8400-e29b-41d4-a716-446655440000
+```
 
-## Response (204 No Content)
+## Errors
 
-Collection deleted successfully. No response body.
-
-## Error Responses
-
-| Code | Description             |
-| ---- | ----------------------- |
-| 401  | Authentication required |
-| 404  | Collection not found    |
-| 500  | Internal server error   |
-
-## Try It Out
+| Status | Body | When |
+| ------ | ---- | ---- |
+| 400 | `{"error": "invalid collection id"}` | malformed id |
+| 500 | `{"error": "..."}` | unexpected server error |