docs(api): add WebSocket real-time sync API documentation

- sync_api.md - Comprehensive WebSocket API guide

Covers:
- Connection and authentication (JWT + device)
- Client→Server messages (subscribe, ping)
- Server→Client messages (progress, conflicts, scan status, etc.)
- Message formats with examples
- Connection lifecycle
- Topics: progress, conflicts, scanner, devices, queue
- JavaScript usage example with reconnection
- Best practices for heartbeat and error handling

Documents bidirectional real-time sync API

docs/developer/api/koreader/sync_progress.md

@@ -0,0 +1,67 @@
+# Sync Progress
+
+Sync reading progress from KOReader device.
+
+**Endpoint**: `POST /api/sync/koreader/progress`
+**Auth**: Required (Device authentication)
+
+## Device Authentication
+
+This endpoint requires device authentication (not user JWT). Devices authenticate using their device credentials.
+
+## Request Body
+
+| Field | Type | Required | Description |
+|--------|------|-----------|-------------|
+| device_id | string (UUID) | Yes | Device UUID |
+| progress | array | Yes | Array of progress objects |
+
+### Progress Object
+
+| Field | Type | Required | Description |
+|--------|------|-----------|-------------|
+| book | string | Yes | Book identifier (filename or UUID) |
+| percent | float | Yes | Progress percentage (0-100) |
+| page | integer | No | Current page number |
+| total_pages | integer | No | Total pages in document |
+| date_read | string | No | ISO 8601 timestamp of last read |
+| updated_at | string | Yes | ISO 8601 timestamp |
+
+### Example Request
+
+```json
+{
+  "device_id": "550e8400-e29b-41d4-a716-446655440000",
+  "progress": [
+    {
+      "book": "book.epub",
+      "percent": 75.5,
+      "page": 150,
+      "total_pages": 200,
+      "date_read": "2026-02-08T10:00:00Z",
+      "updated_at": "2026-02-08T10:00:00Z"
+    }
+  ]
+}
+```
+
+## Response (200 OK)
+
+```json
+{
+  "message": "Progress synced successfully",
+  "synced_count": 1
+}
+```
+
+## Error Responses
+
+| Code | Description |
+|------|-------------|
+| 401 | Device authentication failed |
+| 400 | Invalid request data |
+| 404 | Device not found |
+
+## Try It Out
+
+<!-- API Explorer will be inserted here in Phase 3 -->