Access control

## Summary
We need an authorization mechanism to manage backend permissions. Every API endpoint must be explicitly protected against unauthorized access. The system must differentiate privileges between Administrators, standard Users, and Guests (with posibility to extend it easily) using specific access control model (e.g. Roles, Claims).

## Acceptance criteria
- [ ] Evaluate and choose between RBAC (Role-Based Access Control) or CBAC (Claims-Based Access Control) documenting the decision.
- [ ] Ensure all existing and future endpoints require authentication by default, requiring explicit opt-outs for public endpoints (or in opposite if justified)
- [ ] Define and implement the base set of privileges within the chosen model.
- [ ] Ensure that backend consistently returns appropriate HTTP status codes and that they are documented in API docs.

## Visuals (optional)
screenshots, figma links, etc.

## Notes
This might help to determine what would fit best as an access control model for our app: https://stackoverflow.com/questions/22814023/role-based-access-control-rbac-vs-claims-based-access-control-cbac-in-asp-n