Basic Role Based Acccess Management

[dominic22]

A user has a role which identifies privileges he is able to do.

For simplification this role can be: 'admin' or 'user'!

Admins can for instance users of other companies or update/delete other users which are not themself.

Role can be extracted from jwt of the bearer token!

Create admin user on startup like the api server via admin.ts tool!

adjust authorization mechamism to consider admin privileges!
tests for the admin authorization mechanism

[dominic22]

maybe we also need an organization admin as well. these admins are able to delete users from their organization but not from others.

so 3 roles:
admin > org-admin > user