feat(auth): public self-registration endpoint for restricted dataset access

[KinshukSS2]

feat(auth): public self-registration endpoint for restricted dataset access

Summary

Adds the public POST /Register endpoint so external users can self-register for restricted STAC dataset access. Accounts land in role='pending' with zero privileges — an admin must explicitly activate them via the existing POST /Users/{id}/activate. This closes the gap in the ODRL pipeline: the RESTRICTED_REQUEST audit action type existed in the schema but had no producer.

---

Files Changed

File	Change
api/app/models/register_request.py	New. ContactInfo (6 optional strings) + RestrictedRegistrationRequest Pydantic schema
api/app/v1/endpoints/create/register_request.py	New. POST /Register handler — hashing, JSONB merge, atomic DB transaction
api/app/v1/api.py	Modified. Import + include_router under AUTHORIZATION guard

No schema changes. No new dependencies. No DDL issued.

---

Key Implementation Details (for reviewer)

No auth required — endpoint is intentionally public. Security boundary is the DB: role='pending' has no RLS privileges.

Non-blocking bcrypt — pwd_context.hash is offloaded via asyncio.to_thread to avoid stalling the event loop.

Single atomic transaction — all three writes share one conn.transaction():

1. INSERT INTO "User" … RETURNING id
2. UPDATE "User" SET uri = '/Users(' || id || ')'
3. INSERT INTO "AuditLog" via log_audit_event()

If the audit INSERT fails, the user row rolls back too — no orphaned accounts without a paper trail.

JSONB serialisation — contact_info.model_dump() + explanation merged into one dict → json.dumps() → $N::jsonb cast. Follows the pattern in audit_crud.py (asyncpg does not auto-serialise dicts).

---

Test Evidence

Assertion	Result
POST /Register → HTTP 201, returns {id, status: "pending"}	✅
User.role = 'pending', status = 'active'	✅
User.uri = '/Users(3)' (RETURNING id)	✅
User.password is bcrypt hash ($2b$12$…), not plain text	✅
User.contact JSONB contains all contact_info fields + explanation	✅
AuditLog row: action_type=RESTRICTED_REQUEST, correct actor_id, dataset_id, odrl_policy_id	✅
Duplicate username → HTTP 409	✅
Missing required fields → HTTP 422 (Pydantic)	✅

Full DB output in pr3_test_report.md.

---

How to Test Locally

curl -s -X POST http://localhost:8018/istsos4/v1.1/Register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "reviewer_test",
    "password": "testpass123",
    "dataset_id": "stac-collection-xyz",
    "odrl_policy_id": "policy-456",
    "explanation": "Reviewer smoke test.",
    "contact_info": {"company": "SUPSI"}
  }'
# Expect: HTTP 201  {"id": ..., "status": "pending"}

Then verify in DB:

SELECT id, role, uri, password, contact FROM sensorthings."User" WHERE username = 'reviewer_test';
SELECT action_type, dataset_id, odrl_policy_id FROM sensorthings."AuditLog" WHERE actor_id = <id>;