Auth

Email+password sessions for outside users. Signup/login mint a short-lived session credential and return the same <prefix>.<suffix> bearer API keys use; logout revokes it.

postEmail+password signup; mints a session credential.

Creates an account with entitlement mask 7 (no APITrading), stores the password (argon2id), and mints a session credential. `session_token` is a standard `<prefix>.<suffix>` bearer, returned exactly once, expiring after 7 days.

postEmail+password login; mints a session credential.

Verifies the password and mints a fresh 7-day session credential. Failed logins are uniformly `401 unauthorized` whether the email is unknown or the password wrong (equalized timing) — the endpoint is not an account-existence oracle.

postRevoke the current session credential.

Revokes the session credential authenticating this request; takes effect immediately. Only session credentials may call logout — an API key gets `400 invalid_request` (revoke keys via `DELETE /v1/credentials/{credential_id}`).