feat: implement spatial boundary checks for Bari municipal area in GeoJSON handling

docs/API_SPEC.md

@@ -51,6 +51,7 @@ Authorization: Bearer <token>
   public external-team summary link
 - `GET /open-data/reports`
   anonymized reports in `RESOLVED` or `CLOSED`
+  filtered to Bari municipal boundary
 
 ## User Reference / Personal
 - `GET /report-categories`
@@ -63,6 +64,7 @@ Authorization: Bearer <token>
 ## Report Endpoints
 - `POST /reports`
   create citizen report, optional inline `media`, area inferred by GeoJSON
+  coordinates must stay inside allowed Bari municipal boundary
 - `GET /reports`
   citizen sees own reports; operator/admin see all
 - `GET /reports/{id}`
@@ -111,6 +113,7 @@ Authorization: Bearer <token>
 - `PATCH /admin/categories/{id}`
 - `POST /admin/areas`
 - `PATCH /admin/areas/{id}`
+  area polygon must stay inside allowed Bari municipal boundary
 - `POST /admin/teams`
 - `PATCH /admin/teams/{id}`
 - `GET /admin/users`
@@ -153,3 +156,5 @@ Authorization: Bearer <token>
 - `assignments` is historical external team linkage only.
 - Feedback does not auto-close report.
 - Public intervention summary exposes citizen phone by design, but not email or full surname.
+- Report coordinates are constrained to Bari municipal boundary.
+- Admin-created area polygons must stay inside Bari municipal boundary.