@router.post("/register", status_code=201)
async def register(payload: RegisterIn, request: Request, response: Response,
                   db: AsyncSession = Depends(get_db)):
    existing = (await db.execute(select(User).where(User.email == payload.email.lower()))).scalar_one_or_none()
    if existing:
        raise HTTPException(409, "Email already registered")
    user = User(email=payload.email.lower(), password_hash=hash_password(payload.password),
                full_name=payload.full_name, is_admin=True)
    db.add(user)
    await db.commit()
    token = create_access_token(user.id)
    _set_session_cookie(response, token)
    await log_audit(db, user.id, "user.register", "user", user.id,
                    {"email": user.email}, request.client.host)
    return {"id": user.id, "email": user.email, "token": token}


@router.post("/login")