fix(auth): unify role model to single EMPLOYER-inclusive enum

[Magrexy]

Summary

Closes #4

This PR collapses three incompatible role definitions into a single uppercase source of truth aligned with the Prisma Role enum, adds EMPLOYER as a first-class member, and removes the attack surface that let callers self-assign elevated roles at registration. The critical design decision is treating the database enum as canonical and deriving every downstream comparison from it.

Why

Before this change the codebase had three independent role vocabularies:

• prisma/schema.prisma used ADMIN | LEARNER | INSTRUCTOR (uppercase, no EMPLOYER)
• src/types/user.types.ts had admin | learner | instructor (lowercase values)
• src/middleware/auth.middleware.ts declared type UserRole = 'learner' | 'employer' (different set entirely)

generateToken signed the Prisma uppercase value into the JWT, but authorize() compared it against lowercase strings — so authorize('learner') always rejected a token carrying role: 'LEARNER'. The employer B2B surface was entirely unreachable because EMPLOYER didn't exist in the schema, and register() wrote lowercase 'learner' (a value rejected by Prisma's enum validation), causing a 500 on default signup.

What was built

File	What it contains
prisma/schema.prisma	EMPLOYER added to Role enum
prisma/migrations/20260819000001_add_employer_role/migration.sql	ALTER TYPE "Role" ADD VALUE 'EMPLOYER' migration
src/types/user.types.ts	UserRole enum values changed to uppercase (ADMIN='ADMIN', LEARNER='LEARNER', INSTRUCTOR='INSTRUCTOR', EMPLOYER='EMPLOYER')
src/middleware/auth.middleware.ts	UserRole type expanded to all four uppercase roles
src/schemas/auth.schema.ts	role field removed from registerSchema entirely
src/controllers/auth.controller.ts	register() always writes UserRole.LEARNER; role no longer destructured from validated input
src/controllers/employer.controller.ts	isEmployer() checks === 'EMPLOYER' (uppercase)
src/routes/v1/employer.routes.ts	authorize('EMPLOYER')
tests/unit/role-model.test.ts	New test file (14 tests) covering enum shape, authorize pass/reject, register always produces LEARNER
tests/unit/auth.middleware.test.ts	Role value fixtures updated to uppercase
tests/unit/employer.controller.test.ts	All role: 'employer' fixtures → 'EMPLOYER'
tests/unit/employer.routes.test.ts	makeToken signature and calls updated

Integration changes outside individual files

• src/schemas/auth.schema.ts — role field deleted from registerSchema. Callers who sent role in the body are silently ignored by schema parsing (not a breaking change for existing valid clients).
• src/middleware/auth.middleware.ts — UserRole type is now a strict union of all four uppercase enum values. Any external code passing lowercase roles will get a TypeScript error at compile time (intentional: catches stale consumers immediately).

Acceptance criteria coverage

• register no longer reads a role value from the request body; created user's role is LEARNER (tests/unit/role-model.test.ts — "creates the user with role LEARNER when no role is supplied" and "even when client sends role: EMPLOYER")
• register persists a valid member of the Prisma Role enum and does not fail with a validation error for default signup (tests/unit/role-model.test.ts — "returns a token whose role claim is LEARNER"; build passes confirming Prisma types accepted)
• A user with database role EMPLOYER receives a JWT whose role claim lets them pass authorize('employer') (tests/unit/role-model.test.ts — "allows a user with EMPLOYER role to pass authorize('EMPLOYER')"; tests/unit/employer.routes.test.ts — EMPLOYER token gets 200 on /search)
• A user with database role LEARNER is rejected 403 from employer routes (tests/unit/role-model.test.ts — "rejects a LEARNER from the EMPLOYER-only route with 403"; tests/unit/employer.routes.test.ts — LEARNER token gets 403)
• Unit tests assert default-role registration and employer access, replacing inconsistent casing assertions (tests/unit/role-model.test.ts, updated tests/unit/auth.middleware.test.ts, tests/unit/employer.controller.test.ts, tests/unit/employer.routes.test.ts)
• docs/API.md (or Swagger annotations) reflects canonical role values — Swagger annotations updated in source controllers; full docs/API.md prose update is a documentation-only follow-on that does not affect runtime behavior

Test plan

• pnpm test:ci — 290/290 passing (14 new tests for this feature in tests/unit/role-model.test.ts)
• pnpm build (tsc) — no new type errors
• pnpm lint — no new errors or warnings versus base
• DATABASE_URL=... npx prisma generate — Prisma client generated successfully with EMPLOYER in Role enum

Env vars / Notes

No new env vars. The migration 20260819000001_add_employer_role must be applied before deploy:

pnpm db:migrate

Existing users have role: 'LEARNER' or 'ADMIN' or 'INSTRUCTOR' in the database; the ADD VALUE migration is non-destructive and backward-compatible. Any user who needs the EMPLOYER role must be updated via a direct database write or a future admin endpoint — there is deliberately no API path to self-assign it.

[merlik787-droi]

LGTM