AUTH-001: User login flow — email/password authentication with session management

## Overview
Implement the user login page and session management. Users can sign in with email and password. Session token is stored client-side and sent with subsequent API requests.

## Acceptance Criteria
- [ ] Login form with email + password fields and validation
- [ ] Successful auth stores a session token (localStorage or cookie)
- [ ] Failed auth shows a user-friendly error message
- [ ] 'Sign In' button in the header updates to show the logged-in user's name
- [ ] Session survives page reload

## Notes
All account-related features (Wishlist, Order History, Reviews) depend on this.

Start by locating the existing page structure, header, and API request handling. Implement the login form, authentication feedback, client-side session persistence, and header state described in the acceptance criteria. Done means successful sessions survive reloads, failed sign-ins show a friendly error, and the logged-in user's name replaces the Sign In button.

Written by the indexing model from the issue text.