post:
  summary: Log in
  operationId: loginUser
  tags:
    - Users
  requestBody:
    required: true
    content:
      application/json:
        schema:
          type: object
          required:
            - email
            - password
          properties:
            email:
              type: string
              format: email
              example: lee@example.com
            password:
              type: string
              example: supersecret123
  responses:
    '200':
      description: >
        Login successful. Sets an HttpOnly `token` cookie containing a signed
        JWT (HS256) with the user's `id` and `uuid_key`, expiring in 7 days.
      headers:
        Set-Cookie:
          description: HttpOnly auth cookie.
          schema:
            type: string
            example: token=<jwt>; Path=/; HttpOnly; SameSite=Strict
      content:
        application/json:
          schema:
            $ref: '../components/schemas/SuccessResponse.yaml'
    '401':
      description: Invalid credentials.
      content:
        application/json:
          schema:
            $ref: '../components/schemas/ErrorResponse.yaml'
          example:
            error: Invalid email or password
    '500':
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '../components/schemas/ErrorResponse.yaml'