(setup, as anna) PUT /api/v1/koreader-users/me/sync?enabled=true -> 405
(setup, as anna) PATCH /api/v1/koreader-users/me/sync?enabled=true -> 204
# item 4, 2026-10-01T19:22:35Z: e-reader clients on the PATH EXCEPTION — no family cookie; the app's own login decides
  OPDS catalog, the OPDS user's own login                    LAN    -> 200 app '<?xml version="1.0" encoding="UTF-8"?>\n<feed xmlns="http://www.w3.org/'
  OPDS catalog, the OPDS user's own login                    tunnel -> 200 app '<?xml version="1.0" encoding="UTF-8"?>\n<feed xmlns="http://www.w3.org/'
  OPDS v2, the OPDS user's own login                         LAN    -> 200 app '<!doctype html>\n<html lang="en">\n\n<head>\n  <meta charset="utf-8">\n  <t'
  OPDS, WRONG password (a stranger)                          LAN    -> 401 app 'HTTP Status 401 - Bad credentials'
  OPDS, no credentials (a stranger)                          tunnel -> 401 app 'HTTP Status 401 - Full authentication is required to access this resou'
  Kobo sync initialization, the device's token               LAN    -> 000 app ''
  Kobo library sync, the device's token                      tunnel -> 000 app ''
  Kobo, a made-up token (a stranger)                         tunnel -> 401 app '{"timestamp":"2026-10-01T19:23:12.405Z","status":401,"error":"Unauthor'
  KOReader sign-in, its own user + md5 key                   LAN    -> 200 app '{"username":"korolvaso"}'
  KOReader progress, its own user + md5 key                  tunnel -> 404 app '{"message":"Book not found for hash 0000","status":404,"timestamp":"20'
  KOReader sign-in, WRONG key (a stranger)                   tunnel -> 401 app '{"timestamp":"2026-10-01T19:23:15.609Z","status":401,"error":"Unauthor'
  KOReader create-user (registration, a stranger)            tunnel -> 401 app '{"timestamp":"2026-10-01T19:23:17.132Z","status":401,"error":"Unauthor'
  Komga API (Mihon/Tachiyomi), the OPDS user                 LAN    -> 403 app '{"timestamp":"2026-10-01T19:23:17.408Z","status":403,"error":"Forbidde'
  Komga API, no credentials (a stranger)                     tunnel -> 401 app 'HTTP Status 401 - Full authentication is required to access this resou'
  -- the exception must not leak the rest of the app:
  path trick ../ out of the exception (raw)                  tunnel -> 401 GATE '{"error":"sign in with your family login"}'
  path trick %2e%2e out of the exception                     tunnel -> 401 GATE '{"error":"sign in with your family login"}'
  an app API path that is NOT excepted                       tunnel -> 401 GATE '{"error":"sign in with your family login"}'
  prefix look-alike /api/v1/opdsx                            tunnel -> 401 app '{"timestamp":"2026-10-01T19:23:24.761Z","status":401,"error":"Unauthor'
## item 4 (Kobo, again with a 90 s wait), 2026-10-01T19:23:39Z
  Kobo /v1/initialization, the device's token (LAN) -> 200 in 0.2s app '{"Resources":{"user_tasteprofile_genre":"https://storeapi.kobo.com/v2/user/tasteprofile/ge'
  Kobo /v1/library/sync, the device's token (LAN) -> 200 in 0.3s app '[{"DeletedTag":{"Tag":{"Id":"BL-S-1"}}}]'