User

Exchanges an email and a password for the bearer JWT every other call on this surface needs. Send {"email": "...", "password": "..."}; the response carries token, the user, and the first active account they belong to. Send the token as Authorization: Bearer <token>.

A wrong password and an unknown address answer the same UNAUTHENTICATED, on purpose: the difference between them is an answer to "is this person registered here?".

Trades the one-time signup_token from POST /site-api/v1/users for a bearer JWT, so a user who has just signed up is logged in without retyping the password they chose a moment ago. The token is single-use, short-lived, and burned on the first exchange.

Finishes a password reset: send the token from the mailed link together with the new password. The token is single-use and expires, so a link that has been used or sat too long is UNAUTHENTICATED rather than silently accepted.

Starts a password reset: send {"email": "..."} and, if that address is registered, a mail goes out with a one-time link. The response is the same either way — a different answer for an unknown address would turn this into a way to enumerate accounts.