Added a `users.role` model (`admin` | `user`) and enforced that `POST /api/auth/register` is callable only by admins, so account creation is no longer publicly or non-admin accessible.
Scattered source updates, isolated context, and manual follow-up across multiple feeds.
Introduced role-based access control in the auth flow by persisting user roles, migrating existing accounts to an admin baseline on upgrade, and adding an admin-only guard for account registration.
Operators and admins gain explicit control over who can onboard new accounts, which reduces unauthorized account creation risk and avoids accidental privilege drift in multi-user deployments; the first user created on fresh installs is set as admin and all later registrations require an authenticated admin session. Technically, this is enforced by a new role column, backfilled migration behavior (`v27`), and `requireAdmin` middleware that returns 403 for non-admin callers, so teams should watch for upgrade scripts that assume open registration, confirm existing installs promote legacy users as intended, and validate downstream middleware that now depends on `role` claims in JWT/request context.
Operators and admins gain explicit control over who can onboard new accounts, which reduces unauthorized account creation risk and avoids accidental privilege drift in multi-user deployments; the first user created on fresh installs is set as admin and all later registrations require an authenticated admin session. Technically, this is enforced by a new role column, backfilled migration behavior (`v27`), and `requireAdmin` middleware that returns 403 for non-admin callers, so teams should watch for upgrade scripts that assume open registration, confirm existing installs promote legacy users as intended, and validate downstream middleware that now depends on `role` claims in JWT/request context.