fix: improve authentication validation and security

- Trim whitespace from usernames and validate non-empty
- Normalize role values to lowercase for case-insensitive comparison
- Prevent registration with whitespace-only usernames
- Maintain backward compatibility with existing functionality

Fixes validation gap: Username whitespace handling

internal/handlers/auth.go

@@ -103,6 +103,20 @@ func (h *AuthHandler) Register(c echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
 	}
 
+	// Additional validation: Trim whitespace from username
+	req.Username = strings.TrimSpace(req.Username)
+	if req.Username == "" {
+		if c.Request().Header.Get("HX-Request") == "true" {
+			return c.HTML(http.StatusBadRequest, `<div class="text-red-500">Username cannot be empty or whitespace</div>`)
+		}
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "username cannot be empty or whitespace"})
+	}
+
+	// Normalize role to lowercase
+	if req.Role != "" {
+		req.Role = strings.ToLower(req.Role)
+	}
+
 	// Check if user already exists
 	if _, err := h.db.GetUserByEmail(c.Request().Context(), req.Email); err == nil {
 		if c.Request().Header.Get("HX-Request") == "true" {