Replace multiple catch blocks with single catch(Throwable) funneled through errorResponse() matching the CompanyController pattern. Also clean jsonResponse to accept data+status only, instantiating Response internally.
Green phase: AuthController handles login (authenticate + create session + set cookie), logout (delete session + clear cookie), and me (return user from request attribute).