Login

Create a session cookie from a valid bearer token.

Body: { "token": "tandem_..." # existing bearer (admin-issued # OR OAuth-issued — both work) }

Sets a HttpOnly Secure SameSite=Lax cookie on success. Returns {"ok": true, "handle": "..."}; the page is responsible for navigating to wherever ?next= said to go (consent UI by default).