refactor(bruno): reorganize file structure from bruno-yaml to flat bruno directory

- Move all files from bruno-yaml/* to bruno/*
- Maintains existing directory structure within categories
- Updates bruno/user/auth files with OAuth2 refresh token flow
- Updates bruno/user/profile files for user profile management
- Adds bruno/dashboard/ directory with dashboard API tests
- Preserves all existing test scenarios and OpenCollection YAML format
- No functional changes - file reorganization only

bruno/user/auth/Login User.yml

@@ -0,0 +1,77 @@
+info:
+  name: Login User
+  type: http
+  seq: 1
+
+http:
+  method: POST
+  url: "{{base_url}}/api/auth/login"
+  body:
+    type: json
+    data: |-
+      {
+        "login": "testuser@example.com",
+        "password": "Test@Pass123!"
+      }
+
+runtime:
+  scripts:
+    - type: after-response
+      code: |-
+        function onResponse(res) {
+          try {
+            const responseBody = res.getBody();
+            const token = responseBody.access_token;
+            const refreshToken = responseBody.refresh_token;
+
+            if (token) {
+              bru.setEnvVar("token", token, { persist: true });
+              console.log("Access token saved:", token);
+            }
+
+            if (refreshToken) {
+              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
+              console.log("Refresh token saved:", refreshToken);
+            }
+
+            if (!token && !refreshToken) {
+              console.log("No tokens found in response.");
+            }
+          } catch (error) {
+            console.error("Error in post-response script:", error.message);
+          }
+        }
+        onResponse(res);
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs: |-
+  ## Login User
+
+    Authenticates a user with email/username and password.
+
+    **Method:** POST
+
+    **Endpoint:** /api/auth/login
+
+    **Request Body:**
+    - `login` (string): Email or username
+    - `password` (string): Password
+
+    **Response:**
+    - `token` (string): JWT token
+     - `user` (object): User details
+       - `id` (string): User ID
+       - `email` (string): Email
+       - `username` (string): Username
+       - `theme` (string): User theme preference
+       - `first_name` (string): First name
+       - `last_name` (string): Last name
+
+    **Status Codes:**
+    - 200: Success
+    - 401: Invalid credentials

bruno/user/auth/Logout User.yml

@@ -0,0 +1,40 @@
+info:
+  name: Logout User
+  type: http
+  seq: 1
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/logout'
+  auth: inherit
+  body:
+    type: json
+    jsonBody: "{\n    \"refresh_token\": \"{{refresh_token"
+  headers:
+  - key: Content-Type
+    value: application/json
+
+docs: |-
+  ## Logout User
+  
+    Logs out the user by revoking their refresh token. If no refresh token is provided, the request succeeds but no token is revoked.
+  
+    **Method:** POST
+  
+    **Endpoint:** /api/auth/logout
+  
+    **Authentication:** Bearer token (optional)
+  
+    **Request Body:**
+    - `refresh_token` (string, optional): Refresh token to revoke
+  
+    **Response:**
+    - `message` (string): Success message
+  
+    **Status Codes:**
+    - 200: Success - user logged out (token revoked if provided)
+    - 401: Unauthorized
+  
+    **Example Response:**
+    ```json
+    {
+      "message": "logged out successfully"

bruno/user/auth/Refresh Token.yml

@@ -0,0 +1,44 @@
+info:
+  name: Refresh Access Token
+  type: http
+  seq: 1
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/refresh'
+  auth: inherit
+  body:
+    type: json
+    jsonBody: "{\n    \"refresh_token\": \"{{refresh_token"
+  headers:
+  - key: Content-Type
+    value: application/json
+
+docs: |-
+  ## Refresh Access Token
+  
+    Refreshes an access token using a valid refresh token. Returns a new access token with 1-hour expiration.
+  
+    **Method:** POST
+  
+    **Endpoint:** /api/auth/refresh
+  
+    **Authentication:** Not required (refresh token is in request body)
+  
+    **Request Body:**
+    - `refresh_token` (string): Valid refresh token UUID
+  
+    **Response:**
+    - `access_token` (string): New JWT access token (1 hour expiration)
+    - `token_type` (string): Token type (usually "Bearer")
+    - `expires_in` (number): Token lifetime in seconds (3600)
+  
+    **Status Codes:**
+    - 200: Success - new access token generated
+    - 401: Unauthorized - invalid or expired refresh token
+  
+    **Example Response (Success):**
+    ```json
+    {
+      "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
+      "token_type": "Bearer",
+      "expires_in": 3600

bruno/user/auth/Register User.yml

@@ -0,0 +1,57 @@
+info:
+  name: Register User
+  type: http
+  seq: 2
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/register'
+  auth: inherit
+  body:
+    type: json
+    jsonBody: "{\n    \"email\": \"testuser@example.com\",\n    \"username\": \"testuser\"\
+      ,\n    \"password\": \"Test@Pass123!\",\n    \"first_name\": \"Test\",\n   \
+      \ \"last_name\": \"User\""
+
+docs: |-
+  ## Register User
+    
+    Creates a new user account with role-based restrictions.
+    
+    **Method:** POST
+    
+    **Endpoint:** /api/auth/register
+    
+     **Request Body:**
+     - `email` (string): Email address
+     - `username` (string): Username
+     - `password` (string): Password
+     - `first_name` (string, optional): First name
+     - `last_name` (string, optional): Last name
+     - `role` (string): User role ("user" or "admin")
+    
+    **Response:**
+     - `token` (string): JWT token
+      - `user` (object): User details
+         - `id` (string): User ID
+         - `email` (string): Email
+         - `username` (string): Username
+     - `theme` (string): User theme preference
+         - `first_name` (string, optional): First name
+         - `last_name` (string, optional): Last name
+         - `role` (string): User role ("user" or "admin")
+    
+    **Status Codes:**
+     - 201: Created
+     - 400: Invalid input data
+     - 403: Forbidden - role-based restrictions apply
+     - 409: User exists
+    
+    **Role Restrictions:**
+     - **First User**: Automatically gets admin role regardless of request
+     - **Existing Admins Present**: Only authenticated admins can create new admin accounts
+     - **No Admins Yet**: Anyone can create first admin (auto-assigned)
+     - **Regular User Creation**: Anyone can create regular user accounts
+     - **Unauthenticated Users**: Can only create first admin, not subsequent admins
+    
+    **Examples:**
+     - First admin creation: `{"email": "admin@example.com", "username": "admin", "password": "password123", "role": "admin"