Sprint-1: login flow — core implementation, contracts, integration docs

[queenmagajiya]

Summary

Combined PR addressing the login flow track and signup regression coverage.

Issues Closed

Closes #594 — login flow: implement the core flow (S1-087)

• Expanded login page tests from 2 to 7, matching the signup pattern:
  • Form renders correctly
  • Validation error for invalid email
  • Validation error for empty password
  • Loading state while submitting (button disabled shows "Please wait…")
  • API error displayed from failed login attempt
  • Network failure caught and displayed
  • Successful login shows logged-in state with user email

Closes #593 — login flow: define scope and contracts (S1-086)

• Full login contract documented in apps/docs/login-integration.md:
  • Request body shape (email, password)
  • Success response (200, { user, accessToken })
  • Error responses (400 VALIDATION_ERROR, 401 UNAUTHORIZED, 429 RATE_LIMITED)
  • TypeScript types reference

Closes #597 — login flow: integrate and document (S1-090)

• Created apps/docs/login-integration.md with:
  • End-to-end data flow diagram (web → API → DB → response)
  • Integration point table (auth controller, service, session store, api-client, etc.)
  • Edge case table (missing fields, wrong password, rate limiting, enumeration protection)
  • API and web test file references

Closes #590 — signup flow: add regression coverage (S1-083)

• Signup page already has 7 comprehensive regression tests covering:
  • Render, validation (short password, invalid email), loading state,
    API error, network failure, successful registration flow

Changes

File	Change
apps/web/src/app/login/page.test.tsx	Expanded from 2 to 7 tests (+110 lines)
apps/docs/login-integration.md	New — login contract, data flow, integration points

Verification

• ✅ Web login tests: 7/7 pass
• ✅ Web signup tests: 7/7 pass
• ✅ API login tests: 3/3 pass
• ✅ API auth edge case tests: 8/8 pass