Domain: User, Session, EmailAddress, DTOs, repositories, services (PasswordHasher, TokenGenerator, Clock). Config: PHP-DI container definitions and Slim routes. Entry point: public/index.php with slim-bridge.
Green phase: Logout calls deleteByToken on SessionRepository. No-op for non-existent tokens.
Green phase: CreateSession generates a token, creates a session with 7-day expiry, and persists it via SessionRepository.
Green phase: AuthenticateUser validates credentials, throws BadRequestException for empty fields, UnauthorizedException for unknown email or wrong password.