feat: Implement role-based registration restrictions and reorganize Bruno collection

- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules

BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure

bruno/user/profile/Get Profile.bru

@@ -0,0 +1,40 @@
+meta {
+  name: Get Profile
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{base_url}}/api/auth/profile
+  body: none
+  auth: inherit
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Get User Profile
+  
+  Retrieves the authenticated user's profile.
+  
+  **Method:** GET
+  
+  **Endpoint:** /api/auth/profile
+  
+  **Authentication:** Required
+  
+   **Response:**
+   - `id` (string): User ID
+   - `email` (string): Email
+   - `username` (string): Username
+   - `theme` (string): User theme preference
+   - `first_name` (string, optional): First name
+   - `last_name` (string, optional): Last name
+  
+  **Status Codes:**
+  - 200: Success
+  - 401: Unauthorized
+}

bruno/user/profile/Update Email.bru

@@ -0,0 +1,46 @@
+meta {
+  name: Update Email
+  type: http
+  seq: 2
+}
+
+put {
+  url: {{base_url}}/api/auth/email
+  body: json
+  auth: inherit
+}
+
+body {
+  {
+    "email": "newemail@example.com"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update Email
+
+  Updates the authenticated user's email address.
+
+  **Method:** PUT
+
+   **Endpoint:** /api/auth/email
+
+  **Authentication:** Required
+
+  **Request Body:**
+  - `email` (string, required): New email address (must be valid email format)
+
+  **Response:**
+  - `message` (string): Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 400: Invalid email format
+  - 401: Unauthorized
+  - 409: Email already taken
+}

bruno/user/profile/Update Password.bru

@@ -0,0 +1,50 @@
+meta {
+  name: Update Password
+  type: http
+  seq: 3
+}
+
+put {
+  url: {{base_url}}/api/auth/password
+  body: json
+  auth: inherit
+}
+
+body:json {
+  {
+    "current_password": "password123",
+    "new_password": "newpassword123",
+    "confirm_password": "newpassword123"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update Password
+  
+  Updates the authenticated user's password.
+  
+  **Method:** PUT
+  
+   **Endpoint:** /api/auth/password
+  
+  **Authentication:** Required
+  
+  **Request Body:**
+  - `current_password` (string, required): Current password for verification
+  - `new_password` (string, required): New password (minimum 6 characters)
+  - `confirm_password` (string, required): Confirmation of new password
+  
+  **Response:**
+  - `message` (string): Success message
+  
+  **Status Codes:**
+  - 200: Success
+  - 400: Password validation failed
+  - 401: Current password incorrect
+  - 401: Unauthorized
+}

bruno/user/profile/Update Profile.bru

@@ -0,0 +1,47 @@
+meta {
+  name: Update Profile
+  type: http
+  seq: 4
+}
+
+put {
+  url: {{base_url}}/api/auth/profile
+  body: json
+  auth: inherit
+}
+
+body:json {
+  {
+    "first_name": "Updated",
+    "last_name": "Name"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update User Profile
+  
+  Updates the authenticated user's profile information.
+  
+  **Method:** PUT
+  
+  **Endpoint:** /api/auth/profile
+  
+  **Authentication:** Required (Bearer token)
+  
+  **Request Body:**
+  - `first_name` (string, optional): First name
+  - `last_name` (string, optional): Last name
+  
+  **Response:**
+  - `message` (string): Success message
+  
+  **Status Codes:**
+  - 200: Success
+  - 400: Invalid request
+  - 401: Unauthorized
+}

bruno/user/profile/Update Theme.bru

@@ -0,0 +1,40 @@
+meta {
+  name: Update Theme
+  type: http
+  seq: 4
+}
+
+put {
+  url: {{base_url}}/api/auth/theme
+  body: json
+  auth: inherit
+}
+
+body:json {
+  {
+    "theme": "dracula"
+  }
+}
+
+docs {
+  ## Update User Theme
+  
+  Updates the authenticated user's theme preference.
+  
+  **Method:** PUT
+  
+  **Endpoint:** /api/auth/theme
+  
+  **Authentication:** Required (Bearer token)
+  
+  **Request Body:**
+  - `theme` (string): Theme name (tokyo-night, dracula, nord, solarized-dark, monokai, one-dark-pro, material-dark, catppuccin-mocha, catppuccin-macchiato, catppuccin-frappe, catppuccin-latte)
+  
+  **Response:**
+  - `message` (string): Success message
+  
+  **Status Codes:**
+  - 200: Success
+  - 400: Invalid theme
+  - 401: Unauthorized
+}

bruno/user/profile/Update Username.bru

@@ -0,0 +1,46 @@
+meta {
+  name: Update Username
+  type: http
+  seq: 1
+}
+
+put {
+  url: {{base_url}}/api/auth/username
+  body: json
+  auth: inherit
+}
+
+body {
+  {
+    "username": "newusername"
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  ## Update Username
+
+  Updates the authenticated user's username.
+
+  **Method:** PUT
+
+   **Endpoint:** /api/auth/username
+
+  **Authentication:** Required
+
+  **Request Body:**
+  - `username` (string, required): New username (3-50 characters)
+
+  **Response:**
+  - `message` (string): Success message
+
+  **Status Codes:**
+  - 200: Success
+  - 400: Invalid username
+  - 401: Unauthorized
+  - 409: Username already taken
+}