test: add failing authenticate user test

Red phase: write AuthenticateUserTest with cases for valid credentials, empty email/password (null and empty string), unknown email, wrong password, and fresh instance guarantee. Fakes included.

backend/composer.json

@@ -20,5 +20,8 @@
         "slim/slim": "4.*",
         "slim/psr7": "^1.8",
         "php-di/slim-bridge": "^3.4"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "^13.1"
     }
 }