Add user authorization

docs/PROJECT_SPEC.md

@@ -11,6 +11,9 @@ assign and resolve interventions while preserving history and basic analytics.
   reports and messages citizens.
 - `admin`: manages users, roles, reference data, teams, areas and all reports.
 
+The system admin seed must change password before using protected operational
+or administrative APIs.
+
 ## Report Statuses
 - `OPEN`: created and waiting for review.
 - `UNDER_REVIEW`: an operator is checking the report.
@@ -33,4 +36,3 @@ assign and resolve interventions while preserving history and basic analytics.
 - Route optimization.
 - Public open data export.
 - Full Docker packaging of the backend.
-