Exchanges email/password credentials for a JWT token.

On success returns a token that must be included on every subsequent
request as an HTTP header:

Authorization: Bearer <token>

Runtime override (MCP / FastMCP integration):
Clients built on top of this spec (e.g. an MCP server generated with
FastMCP via FastMCP.from_openapi) can override the Authorization
header per-request at runtime to rotate tokens or impersonate users
without restarting the MCP server.

Rate limit: 100 requests/minute per IP. Auth failures do not leak
which of (email, password) was wrong.