Overview
Authentication and identity. POST /auth/login takes a username and
password and sets a user session cookie. API tokens (aa_pat_…) are
the alternative for scripts and programmatic clients — mint one with
POST /auth/tokens and send it as Authorization: Bearer aa_pat_….