feat: implement spatial boundary checks for Bari municipal area in GeoJSON handling

docs/ARCHITECTURE.md

@@ -47,6 +47,8 @@ Effective permission helpers:
 - `take` exists for `OPEN -> UNDER_REVIEW` without team assignment.
 - External team link is public, revocable, tied to current assignment, hashed in
   `intervention_access_links`.
+- Spatial scope is constrained to Bari municipal boundary from
+  `allowed_boundaries.code = 'BARI'`.
 
 ## Status Machine
 - Allowed statuses: `OPEN`, `UNDER_REVIEW`, `ASSIGNED`, `IN_PROGRESS`,
@@ -68,6 +70,7 @@ Effective permission helpers:
 - `moderation_flags`
 - `report_category_team_categories`
 - `intervention_access_links`
+- `allowed_boundaries`
 
 ## HTTP/Error Conventions
 - `401`: missing/invalid auth
@@ -94,4 +97,5 @@ Output path:
   hardcoded allowlist, not user input.
 - Public intervention summary currently excludes email and full surname, but
   still exposes citizen phone by design.
+- Allowed-area containment for admin areas is vertex-based, simple not strict GIS-hard.
 - No frontend doc set here beyond API/OpenAPI docs.