Login uses /api/auth/login and stores token in browser localStorage (temporary for MVP).
/api/auth/login
After login, click “Load Profile” to verify role-based access.