Green phase: CreateSession generates a token, creates a session with 7-day expiry, and persists it via SessionRepository.
Green phase: AuthenticateUser validates credentials, throws BadRequestException for empty fields, UnauthorizedException for unknown email or wrong password.