feat(router): add routes for consolidated user management

Add DELETE /api/auth/users/:id, PUT /api/auth/users/:id/password, and
PUT /api/auth/users/:id routes. Remove individual profile update routes
in favor of consolidated endpoints.

internal/router/auth.go

@@ -21,7 +21,6 @@ func registerAuthRoutes(cfg *Config, rateLimitMiddleware echo.MiddlewareFunc) {
 
 	// Protected auth routes
 	protected.GET("/auth/profile", cfg.AuthHandler.GetProfile)
-	protected.PUT("/auth/profile", cfg.AuthHandler.UpdateProfile)
 
 	// Refresh token endpoint (no authentication required - uses refresh token from body)
 	e.POST("/api/auth/refresh", cfg.AuthHandler.RefreshAccessToken)
@@ -31,13 +30,18 @@ func registerAuthRoutes(cfg *Config, rateLimitMiddleware echo.MiddlewareFunc) {
 
 	// Auth update routes
 	authGroup := e.Group("/api/auth", createJWTMiddleware(cfg))
-	authGroup.PUT("/email", cfg.AuthHandler.UpdateEmail)
-	authGroup.PUT("/username", cfg.AuthHandler.UpdateUsername)
 	authGroup.PUT("/password", cfg.AuthHandler.UpdatePassword)
 	authGroup.PUT("/theme", cfg.AuthHandler.UpdateTheme)
 
-	// Admin-only routes for user management
+	// Profile management (combined handlers - self-edit)
+	authGroup.PUT("/profile", cfg.AuthHandler.UpdateProfile)
+	authGroup.DELETE("/profile", cfg.AuthHandler.DeleteUser)
+
+	// Admin-only routes (same handlers with URL param)
 	admin := protected.Group("/auth", handlers.AdminMiddleware)
 	admin.GET("/users", cfg.AuthHandler.ListUsers)
 	admin.PUT("/users/:id/max-devices", cfg.AuthHandler.UpdateUserMaxDevices)
+	admin.PUT("/profile/:id", cfg.AuthHandler.UpdateProfile)
+	admin.PUT("/password/:id", cfg.AuthHandler.UpdatePassword)
+	admin.DELETE("/profile/:id", cfg.AuthHandler.DeleteUser)
 }