docs(auth): document 7-day session authentication with constants

- Add comprehensive authentication overview.md explaining:
  - 7-day session duration for JWT and refresh tokens
  - Constants-based implementation (no hardcoded values)
  - Complete authentication flow (register/login/refresh/logout)
  - Session expiration handling (HTML redirect vs JSON error)
  - Security features (HTTP-only cookies, token rotation)
  - Token storage recommendations
- Update login.md with 7-day expires_in field and cookie MaxAge
- Update register.md with 7-day session duration details
- Update refresh_token.md with expires_in: 604800

Documentation provides complete reference for authentication
endpoints with examples and security considerations.

docs/developer/api/authentication/login.md

@@ -4,20 +4,20 @@ Authenticate with email and password.
 
 **Endpoint**: `POST /api/auth/login`
 **Auth**: Not required
-**Content-Type**: `application/json`
+**Content-Type**: `application/json` or `application/x-www-form-urlencoded`
 
 ## Request Body
 
 | Field | Type | Required | Description |
 |--------|------|-----------|-------------|
-| email | string | Yes | User's email address |
+| login | string | Yes | User's email address or username |
 | password | string | Yes | User's password |
 
 ### Example Request
 
 ```json
 {
-  "email": "user@example.com",
+  "login": "user@example.com",
   "password": "SecureP@ss123!"
 }
 ```
@@ -28,18 +28,30 @@ Authenticate with email and password.
 {
   "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
   "refresh_token": "d4f5g6h7...",
+  "token_type": "Bearer",
+  "expires_in": 604800,
   "user": {
     "id": "uuid-here",
     "email": "user@example.com",
     "username": "john",
+    "first_name": "John",
+    "last_name": "Doe",
     "role": "user"
   }
 }
 ```
 
+**Set-Cookie Header**:
+```
+Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly
+```
+
+**Session Duration**: 7 days (604800 seconds)
+
 ## Error Responses
 
 | Code | Description |
 |------|-------------|
 | 401 | Invalid email or password |
 | 400 | Missing required fields |
+| 429 | Too many login attempts |