Shared email+password admin sign-in → returns the admin token.

A friendlier alternative to pasting admin_token directly or using the magic link: POST {"email": ..., "password": ...} and, on a correct match, get back the same token the rest of /v1/admin/* expects in X-Storyflo-Email-Token.

Auth: ADMIN_LOGIN_EMAIL + ADMIN_LOGIN_PASSWORD env vars, matched against ADMIN_TOKEN as the returned secret. When any of the three is unset the endpoint is disabled (503) — we never authenticate against a blank credential.

The /v1/admin/* per-IP rate-limit middleware (_admin_path_rate_limit) already throttles this path by prefix, on top of the per-route limit above, so credential-stuffing is bounded.

Errors:

• 503 password login not configured (any of email/password/token unset)
• 401 invalid credentials (generic — bad email and bad password are indistinguishable, by status and body and by timing)