docs(media-items,collections,koreader,admin): Beam batch 11 — final backfill

All remaining endpoint docs frontmatter'd: media-item bulk ops + audio
surface, collections book-listing/preview, koreader rating/review/stats
plugin protocol, hash-conflicts JSON list.

Scope call (Claude): resolve_hash_conflict.md DELETED — the resolve POST
renders an htmx fragment (renderResolved), a web-admin flow under rule 3;
only the GET list is a JSON API. update_media_review skipped by Beam
(correct): ratings/upsert_media_review.md already covers the PUT.

Registry: 16 entries. koreader rating/review/stats all bind
koreaderBookRef (query or body) — odd=half-star rating scale; audio track
endpoint serves raw bytes (ServeContent, Range) — response nil. Fixed
drift: deleted_annotations doc's secondary restore/purge fences
unlabeled (gate validates labeled blocks against the ONE frontmatter
route); chapters example labeled. UNVERIFIED: 1 (koreader book-ref
fields, push_stats). make test 9/9.

internal/docs/schema.go

@@ -860,4 +860,101 @@ var Schemas = map[string]Schema{
 			"device_shelf_name": "", "sync_direction": "", "created_at": ""
 		}`),
 	},
+
+	// --- Beam batch 11: final backfill ---
+	"GET /api/collections/:id/books": {
+		// Reverse listing: which collections carry this book.
+		Response: json.RawMessage(`{
+			"book_id": "", "collections": [], "total": 0
+		}`),
+	},
+	"POST /api/collections/:id/books/bulk-remove": {
+		Request:  handlers.BulkRemoveBooksRequest{},
+		Response: json.RawMessage(`{"removed": 0, "total": 0}`),
+	},
+	"POST /api/collections/bulk-add-books": {
+		Request: json.RawMessage(`{
+			"operations": [{"collection_id": "", "book_ids": []}]
+		}`),
+		Response: json.RawMessage(`{"results": [], "total": 0}`),
+	},
+	"POST /api/collections/preview": {
+		// Smart-collection dry run — inline request struct.
+		Request: json.RawMessage(`{
+			"library_id": "", "rules": [], "manual_book_ids": [], "limit": 0
+		}`),
+		Response: json.RawMessage(`{"items": []}`),
+	},
+	"DELETE /api/devices/:id/collections/:collectionId": {
+		// 204 No Content.
+	},
+	"POST /api/media-items/bulk-delete": {
+		Request: json.RawMessage(`{"media_item_ids": []}`),
+		Response: json.RawMessage(`{
+			"results": [], "total": 0, "deleted": 0, "failed": 0
+		}`),
+	},
+	"POST /api/media-items/bulk-update": {
+		// updates fields are pointers (partial per-item patch).
+		Request: json.RawMessage(`{
+			"media_item_updates": [
+				{
+					"media_item_id": "",
+					"updates": {
+						"title": "", "author": "", "genre": "",
+						"language": "", "tags": []
+					}
+				}
+			]
+		}`),
+		Response: json.RawMessage(`{
+			"results": [], "total": 0, "updated": 0, "failed": 0
+		}`),
+	},
+	"GET /api/media-items/:id/annotations/deleted": {
+		Response: json.RawMessage(`{
+			"deleted_annotations": [], "total": 0
+		}`),
+	},
+	"GET /api/media-items/:id/chapters": {
+		Response: json.RawMessage(`{
+			"media_item_id": "", "chapters": [], "duration_seconds": 0,
+			"codec_profile": {}, "layout": "", "tracks": []
+		}`),
+	},
+	"GET /api/media-items/:id/audio/:trackIndex": {
+		// Raw audio bytes via http.ServeContent (Range support) — not JSON.
+	},
+	"GET /api/sync/koreader/rating": {
+		// Book identity via query params (uuid/sha256/title/authors).
+		Response: json.RawMessage(`{"rating": null}`),
+	},
+	"POST /api/sync/koreader/rating": {
+		// koreaderBookRef embedded + rating 0-10 (odd = half-star).
+		Request: json.RawMessage(`{
+			"uuid": "", "sha256": "", "title": "", "authors": [], "rating": 0
+		}`),
+		Response: json.RawMessage(`{"rating": null}`),
+	},
+	"GET /api/sync/koreader/review": {
+		Response: json.RawMessage(`{"review": null}`),
+	},
+	"POST /api/sync/koreader/review": {
+		Request: json.RawMessage(`{
+			"uuid": "", "sha256": "", "title": "", "authors": [], "review": ""
+		}`),
+		Response: json.RawMessage(`{"review": null}`),
+	},
+	"POST /api/sync/koreader/stats": {
+		Request: json.RawMessage(`{
+			"uuid": "", "sha256": "", "title": "", "authors": [],
+			"total_seconds": 0
+		}`),
+		Response: AnyJSONObject{}, // hand-built result map
+	},
+	"GET /api/admin/hash-conflicts": {
+		// JSON list endpoint (admin). The resolve POST is an htmx fragment
+		// renderer — deliberately NOT documented (rule 3).
+		Response: json.RawMessage(`{"conflicts": [], "total": 0}`),
+	},
 }