1bb9e4014e
- POST /api/auth/login: rate-limited, sets httpOnly cookie, issues CSRF token - GET /api/auth/me: returns current authenticated user - GET /api/auth/csrf: refreshes CSRF token - POST /api/auth/logout: clears cookies, revokes Emby token - Include x-code-samples (curl, JS fetch, TypeScript) - Include x-integration-notes for cookie flow - Full JSON Schema with realistic examples