feat: Implement role-based registration restrictions and reorganize Bruno collection

- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules

BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure

bruno/user/admin/Delete User Account (Admin).bru

@@ -0,0 +1,54 @@
+meta {
+  name: Delete User Account (Admin)
+  type: http
+  seq: 6
+}
+
+delete {
+  url: {{base_url}}/api/auth/account?user_id={{user_id}}
+  body: none
+  auth: inherit
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Delete User Account (Admin)
+  
+  Allows administrators to delete any user account by specifying user_id parameter.
+  
+  **Method:** DELETE
+  
+  **Endpoint:** /api/auth/account?user_id={user_id}
+  
+  **Authentication:** Required (Admin only)
+  
+  **Query Parameters:**
+  - `user_id` (string, required for admin): UUID of the user account to delete
+  
+  **Usage Examples:**
+  - **Self-deletion**: DELETE /api/auth/account (no user_id parameter)
+  - **Admin deletion**: DELETE /api/auth/account?user_id=550e8400-e29b-41d4-a716-446655440000
+  
+  **Response:**
+  - `message` (string): Success message indicating which account was deleted
+  
+  **Status Codes:**
+  - 200: Success
+  - 400: Bad Request (invalid user_id or attempting to delete last admin)
+  - 401: Unauthorized
+  - 403: Forbidden (admin access required for user_id parameter)
+  - 404: Not Found (user does not exist)
+  
+  **Admin Protection Rules:**
+  - Regular users can only delete their own account (no user_id parameter allowed)
+  - Admins can delete any account including their own
+  - Cannot delete the last admin account in the system
+  - Admin role required to use user_id parameter
+  
+  **Variables:**
+  - `user_id`: Set this to the UUID of the user you want to delete
+}