# Login User

Authenticate with email and password.

**Endpoint**: `POST /api/auth/login`
**Auth**: Not required
**Content-Type**: `application/json` or `application/x-www-form-urlencoded`

## Request Body

| Field    | Type   | Required | Description                      |
| -------- | ------ | -------- | -------------------------------- |
| login    | string | Yes      | User's email address or username |
| password | string | Yes      | User's password                  |

### Example Request

```json
{
  "login": "user@example.com",
  "password": "SecureP@ss123!"
}
```

## Response (200 OK)

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "d4f5g6h7...",
  "token_type": "Bearer",
  "expires_in": 604800,
  "user": {
    "id": "uuid-here",
    "email": "user@example.com",
    "username": "john",
    "first_name": "John",
    "last_name": "Doe",
    "role": "user"
  }
}
```

Note: the access token field is `access_token` (not `token`). Nullable profile fields (`first_name`, `last_name`) may be empty strings.

**Set-Cookie Header**:

```
Set-Cookie: token=eyJhbG...; Max-Age=604800; Path=/; HttpOnly
```

**Session Duration**: 7 days (604800 seconds)

## Error Responses

| Code | Description               |
| ---- | ------------------------- |
| 401  | Invalid email or password |
| 400  | Missing required fields   |
| 429  | Too many login attempts   |