Red phase: AuthControllerTest covers login with valid credentials (returns user+cookie), missing email (400), invalid credentials (401), logout (clears cookie, 204), and me (returns user from attribute).
