API token sign-in

Uses POST /api/v1/auth/login and stores a Sanctum personal access token for fetch calls: sessionStorage by default, or localStorage if you choose Remember me (survives closing the tab). Use web sign-in if you only need a normal browser session.