Login
Backend endpoints:
POST /register and POST /login with JSON { "username": "...", "password": "..." }.