Red phase: LogoutTest covers deleting existing session and no-op for unknown token.
Red phase: CreateSessionTest covers token, user, createdAt, 7-day expiry, persistence, and fresh instance.
Red phase: write AuthenticateUserTest with cases for valid credentials, empty email/password (null and empty string), unknown email, wrong password, and fresh instance guarantee. Fakes included.