fix: restrict public registration roles

[Karam-preet]

Summary

• Restrict public registration to the employer role only.
• Reject registration requests with a missing role.
• Reject unauthorised roles such as admin, super_admin, and branch_admin.
• Remove the previous fallback that allowed other roles to register.
• Add tests covering allowed and rejected public registration roles.

Testing

• npm test -- --runInBand tests/authController.test.js
• All 13 tests passed.

Security Impact

Public registration can no longer be used to create privileged accounts such as administrators. Only the employer role is permitted through the public registration endpoint.