Your first user needs to be created on the config replicaset. As you have enabled authorization you need to use the localhost exception to create the first user.
Run mongosh directly on the mongos server (it has to connect on localhost) and create your user in the admin database. Also create an admin user on each shard replicaset, the localhost exception will remain enabled until this is done(or explicitly disabled on the command line).