fix: allow registration only if authenticated

cmd/server/main.go

@@ -117,13 +117,13 @@ func main() {
 	r.GET("/health", h.Health)
 	r.GET("/hello", h.Hello)
 	r.POST("/login", h.Login)
-	r.POST("/register", h.Register)
 	r.GET("/devices", h.GetDevices)
 
 	// mqttping endpoint handled by internal/handler (protected)
 
 	// Protected routes
 	auth := r.Group("/")
+	auth.POST("/register", h.Register)
 	auth.Use(middleware.AuthMiddleware(cfg.Server.JWTSecret))
 	auth.GET("/protected", h.Protected)
 	auth.GET("/mqttping", h.MQTTPing)