Plan: implement the user authentication flow end to end.
Deliverables: login endpoint, session token issuance, logout.
Goals: secure credential handling, no secrets in logs.
