Add default admin user and admin-only user creation

Features added:
- Automatic creation of default admin user on first startup (login: admin, password: admin)
- Admin-only endpoint POST /api/admin/users for creating new users
- Admin users can set is_admin flag when creating users
- Non-admin users are blocked from accessing admin endpoints

Implementation:
- Added CreateDefaultAdmin() function in internal/database/database.go
  - Checks if any users exist, creates admin only if database is empty
  - Admin user: login "admin", password "admin", is_admin true
- Added CreateUser() method to auth service for admin user creation
- Added CreateUser() handler to auth handler
- Added /api/admin/users endpoint with AuthMiddleware + AdminMiddleware
- Updated README_GOLANG.md with:
  - Default admin credentials
  - Instructions for creating additional users
  - Admin API documentation

Security:
- Default admin password should be changed after first login
- AdminMiddleware ensures only users with is_admin=true can access admin routes
- Non-admin users receive 403 Forbidden when accessing admin endpoints

Tested:
- Default admin creation on startup ✓
- Admin login with default credentials ✓
- Admin can create new users ✓
- New users can login ✓
- Non-admin users blocked from admin endpoints ✓

cmd/tracks/main.go

@@ -48,6 +48,11 @@ func main() {
 		log.Fatal("Failed to run migrations:", err)
 	}
 
+	// Create default admin user if no users exist
+	if err := database.CreateDefaultAdmin(); err != nil {
+		log.Fatal("Failed to create default admin:", err)
+	}
+
 	// Set Gin mode
 	gin.SetMode(cfg.Server.Mode)
 
@@ -148,6 +153,14 @@ func setupRoutes(router *gin.Engine, cfg *config.Config) {
 		}
 	}
 
+	// Admin routes (requires authentication + admin role)
+	admin := api.Group("/admin")
+	admin.Use(middleware.AuthMiddleware(cfg.Auth.JWTSecret))
+	admin.Use(middleware.AdminMiddleware())
+	{
+		admin.POST("/users", authHandler.CreateUser)
+	}
+
 	// CORS middleware for development
 	router.Use(func(c *gin.Context) {
 		c.Writer.Header().Set("Access-Control-Allow-Origin", "*")