Behavior: Validates the user's credentials and, if successful, creates a new session and returns a JWT access token with a refresh token. Accounts that are disabled, expired, pending invitation, or pending approval will be rejected. Guest users must have a valid profile and permitted application access.

Authorization: Public endpoint — no authentication required.

Side Effects: Creates a new user session. The login event is recorded for auditing purposes.

Error Scenarios: Returns 400 if the request body is null. Returns 404 if authentication fails or the user cannot be found. Returns 403 if the user account is Disabled, Expired, PendingInvitation, or PendingApproval. LoginStatus on the response indicates the specific failure reason (e.g., IsDisabled, IsPendingEmailConfirmation, RequiresNewPassword).