Login with email and password
POST /auth/login
Authenticates a user and returns either a session payload or a 2FA challenge.
Request
Login success or 2FA challenge
Invalid credentials or unverified account
CSRF token missing or invalid (EBADCSRFTOKEN)