fix(auth): validate registration payload

[vexnom]

Closes #5965

/claim #5965

Refs #5953 and parent bounty #743.

Summary

• require a non-empty fullName during public registration
• limit public registration roles to client and freelancer
• preserve fullName in the returned user payload
• issue a token whose subject matches the returned user id
• add regression coverage for missing fullName, admin self-assignment rejection, and successful registration
• update the API test script to run test files directly under Node 24

Tests

• npm test -w apps/api

Payout: Base USDC 0x42430d6ade79041f569dc5e28153052ccef82ea6