Verify the password and set the signed session cookie.
Body of POST /admin/api/v1/auth/login.
Single-tenant: there is no username field — the standalone has one admin row identified by the singleton primary key.
Successful Response
Bare-success body for login / logout / change-password.
Login + logout side-effects (session cookie set/cleared) are carried on the HTTP response itself; the body just acknowledges the outcome.