Add user authorization

docs/API_SPEC.md

@@ -11,6 +11,7 @@ Base path: `/api/v1`.
 - `POST /auth/otp/request`: send an OTP email through MailHog.
 - `POST /auth/otp/verify`: verify OTP and create an API token.
 - `POST /auth/login/password`: password login fallback.
+- `POST /auth/change-password`: change the authenticated user's password.
 - `GET /me`: return the authenticated user.
 
 Protected endpoints use:
@@ -35,3 +36,6 @@ Authorization: Bearer <token>
 - `GET|POST /admin/areas`
 - `GET|POST /admin/teams`
 - `GET /admin/stats/overview`
+- `GET /admin/users`
+- `PATCH /admin/users/{id}/roles`
+- `PATCH /admin/users/{id}/ban`

docs/PROJECT_SPEC.md

@@ -11,6 +11,9 @@ assign and resolve interventions while preserving history and basic analytics.
   reports and messages citizens.
 - `admin`: manages users, roles, reference data, teams, areas and all reports.
 
+The system admin seed must change password before using protected operational
+or administrative APIs.
+
 ## Report Statuses
 - `OPEN`: created and waiting for review.
 - `UNDER_REVIEW`: an operator is checking the report.
@@ -33,4 +36,3 @@ assign and resolve interventions while preserving history and basic analytics.
 - Route optimization.
 - Public open data export.
 - Full Docker packaging of the backend.
-