Adds AuthenticatesUsers feature trait that runs the full signup -> confirm -> login flow and exposes the resulting auth cookie. Bumps phpunit defaultTimeLimit to 30 seconds so the multi-bcrypt-per-test feature flow finishes inside the limit.
composer create-project laravel/laravel + artisan install:api. sanctum removed (custom session-cookie auth per ai/backend-context). personal_access_tokens migration + config/sanctum.php deleted. default .gitignore excludes vendor/, .env, etc - composer install recreates vendor at setup time.
