Document how to bootstrap admin access to civicrm

It took me a while to reach that today.

service/crm.md

@@ -140,6 +140,26 @@ accessible only by TPA. To add a user, on the backend server
 
     htdigest /etc/apache2/htdigest 'Tor CRM' $USERNAME
 
+## Granting a new admin access
+
+When onboarding a new TPA member, the new member can create their own admin user
+as soon as they have root access to the server. To achieve this they can use the
+following commands:
+
+    sudo -i -u torcivicrm
+    cd /srv/crm.torproject.org/htdocs-prod && drush uli toradmin
+
+Once logged in a personal account should be created with administrator
+privileges to facilitate future logins.
+
+Notes:
+
+* The URL produced by drush needs to be manually modified for it to lead to the
+  right place. `https` should be used indead of `http`, and the hostname needs
+  to be changed from `default` to `crm.torproject.org`
+* `drush uli` without a user will produce URLs that give out an Access Denied
+  error since the user with uid 1 is disabled.
+
 ## Rotating API tokens
 
 See the [donate site docs for this](service/donate#rotating-api-tokens).