[AUTH-001] Auth: User login flow (email + password)

## Overview
Implement email/password authentication. This is the foundational auth issue that unblocks the majority of Sprint 2 and later work.

## Acceptance Criteria
- [ ] Login modal/page with email + password fields and validation
- [ ] `POST /api/auth/login` returns a JWT access token and refresh token
- [ ] Tokens stored securely (httpOnly cookie for refresh; memory/sessionStorage for access)
- [ ] Header shows user avatar/name when logged in; login button hidden
- [ ] "Sign Out" clears tokens and resets UI state
- [ ] Failed login shows actionable error message (invalid credentials vs. unverified email)
- [ ] Rate limiting: lockout after 5 failed attempts

## Security Requirements
- Passwords must never be logged or exposed in responses
- HTTPS only for auth endpoints
- CSRF protection on token endpoints

## Depends On
- None — this is a foundational issue

## Blocks
- #6 AUTH-002 (registration shares the auth service)
- #7 AUTH-003 (password reset requires user lookup)
- #8 AUTH-004 (token refresh is part of this flow)
- #9 ACC-005 (wishlist requires a user identity)
- #10 ACC-006 (user profile requires auth)
- #11 PROMO-007 (user-specific discounts)
- #14 ORD-001 (orders tied to user accounts)
- #17 ACC-012 (order history)
- #20 REVIEW-001 (reviews require verified purchase)