Scope: POST /api/auth/login (verify password, issue a signed httpOnly session cookie or JWT), POST /api/auth/logout (clear it), GET /api/auth/me (current user).
Done when: valid creds log in, invalid creds 401, the cookie authenticates subsequent requests, logout invalidates it.