feat: Implement role-based registration restrictions and reorganize Bruno collection

- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules

BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure

internal/handlers/auth.go

@@ -136,15 +136,25 @@ func (h *AuthHandler) Register(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to hash password"})
 	}
 
-	// Set role - first user is always admin, otherwise validate requested role
+	// Check if any admin users already exist
+	adminExists := false
+	for _, u := range users {
+		if u.Role == "admin" {
+			adminExists = true
+			break
+		}
+	}
+
+	// Set role - first user is always admin, otherwise validate requested role based on existing admins
 	var userRole string
 	if len(users) == 0 {
 		userRole = "admin" // First user is always admin
 	} else {
 		userRole = req.Role
 		if userRole == "" {
-			userRole = "user"
+			userRole = "user" // Default to regular user if not specified
 		}
+
 		// Validate role for subsequent users
 		if userRole != "user" && userRole != "admin" {
 			if c.Request().Header.Get("HX-Request") == "true" {
@@ -152,6 +162,29 @@ func (h *AuthHandler) Register(c echo.Context) error {
 			}
 			return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid role. must be 'user' or 'admin'"})
 		}
+
+		// Role-based restrictions: only admins can create admin users if any admin already exists
+		if userRole == "admin" && adminExists {
+			// Check if current user is admin (requires authentication)
+			userID := c.Get("user_id")
+			if userID == nil {
+				// Not authenticated - cannot create admin user if admins exist
+				if c.Request().Header.Get("HX-Request") == "true" {
+					return c.HTML(http.StatusForbidden, `<div class="text-red-500">Only existing administrators can create admin accounts</div>`)
+				}
+				return c.JSON(http.StatusForbidden, map[string]string{"error": "only existing administrators can create admin accounts"})
+			}
+
+			// User is authenticated - check their role
+			userRoleAuth := c.Get("user_role").(string)
+			if userRoleAuth != "admin" {
+				// Authenticated but not admin - cannot create admin accounts
+				if c.Request().Header.Get("HX-Request") == "true" {
+					return c.HTML(http.StatusForbidden, `<div class="text-red-500">Only administrators can create admin accounts</div>`)
+				}
+				return c.JSON(http.StatusForbidden, map[string]string{"error": "only administrators can create admin accounts"})
+			}
+		}
 	}
 
 	// Create user