Sign in through `/api/auth/login`. Session bootstrap stores access and refresh tokens locally and uses the backend profile contract.