Spaces Login

Exchange email + password (in the BODY) for a JWT.

One identical refusal for every failure, and a 429 with Retry-After once a failure budget is spent. May return a JSONResponse instead of the declared model for that 429 — deliberate: the monolith's shared exception handlers drop headers, and Retry-After is the point of the status.