feat: Implement precise user registration restrictions

- Implement numbered requirements for user account creation:
  1. No users exist: First user becomes admin
  2. Admins exist: Anyone can register as regular user
  3. Admin logged in: Can create admins and regular users
  4. User logged in: Cannot create any accounts

- Update registration logic in auth.go to validate roles based on existing admin accounts and authentication status
- Add comprehensive error handling for unauthorized user creation attempts
- Ensure security while maintaining usability for regular users

BREAKING CHANGES:
- User accounts creation now restricted based on authentication state
- Regular users cannot create accounts when logged in
- Admin privileges enforced for user management operations

bruno/README.md

@@ -12,14 +12,55 @@ This directory contains Bruno collection for testing the Bookmann API with compr
 
 ## Available Tests
 
-### Auth (Public Endpoints)
-- **Register User**: POST /api/auth/register - Create new account
+### Authentication (Public & Private)
+- **Register User**: POST /api/auth/register - Create new account with role-based restrictions
 - **Login User**: POST /api/auth/login - Authenticate (email or username)
-- **Get Profile**: GET /api/auth/profile - Get user info (requires token)
 
-### User Management (Admin Only)
-- **List Users**: GET /api/auth/users - Get all users with complete profile info (admin only)
-- **Delete Account**: DELETE /api/auth/account - Delete own account or admin deletes other accounts with `user_id` parameter (admin only)
+### User Profile Management
+- **Get Profile**: GET /api/auth/profile - Get current user info
+- **Update Profile**: PUT /api/auth/profile - Update first_name, last_name
+- **Update Email**: PUT /api/auth/email - Update email address
+- **Update Username**: PUT /api/auth/username - Update username
+- **Update Password**: PUT /api/auth/password - Update password
+- **Update Theme**: PUT /api/auth/theme - Update theme preference
+
+### Admin User Management
+- **List Users**: GET /api/auth/users - Get all users with complete info (admin only)
+- **Delete Account**: DELETE /api/auth/account - Delete own account or admin deletes other accounts with `user_id` parameter
+- **Register Admin User**: POST /api/auth/register - Create admin account (requires existing admin authentication)
+
+## Collection Organization
+
+```
+bruno/user/
+├── auth/                    # Authentication requests
+│   ├── Login User.bru      # POST /api/auth/login
+│   └── Register User.bru   # POST /api/auth/register (with restrictions)
+├── admin/                   # Admin-only management
+│   ├── List Users.bru         # GET /api/auth/users (admin only)
+│   ├── Delete Account.bru       # DELETE /api/auth/account (admin override)
+│   └── Register Admin User.bru # POST /api/auth/register (admin creation)
+└── profile/                  # Profile management
+    ├── Get Profile.bru         # GET /api/auth/profile
+    ├── Update Profile.bru       # PUT /api/auth/profile
+    ├── Update Email.bru         # PUT /api/auth/email
+    ├── Update Password.bru       # PUT /api/auth/password
+    ├── Update Theme.bru         # PUT /api/auth/theme
+    └── Update Username.bru       # PUT /api/auth/username
+```
+
+## Security Features
+
+### Registration Restrictions
+- **First User**: Automatically gets admin role regardless of request
+- **Existing Admins**: Only authenticated admins can create new admin accounts  
+- **Regular Users**: Anyone can create regular user accounts
+- **Unauthenticated**: Can only create first admin, not subsequent admins
+
+### Admin Deletion
+- **Self-Deletion**: Users can delete their own accounts
+- **Admin Override**: Admins can delete any user account via `?user_id={uuid}` parameter
+- **Last Admin Protection**: Cannot delete the last admin account in the system
 
 ### User Management (Protected)
 - **Delete Account**: DELETE /api/auth/account - Delete own account (self) or admin deletes other accounts with `user_id` parameter (admin only)