Sign in — e-mail and password

Step one of signing in, by e-mail and password (the e-mail case-insensitive). With 2FA off the login is complete: `200` with the session pair — or, for an account in two or more workspaces, the intermediate `pending_workspace` access token and `refresh_token: null` (WBL-3265). With 2FA on: `202` with a short `pending_2fa` token that opens only the second stage; a six-digit code is mailed unless an authenticator is enrolled (`has_used_qr: true`). Same contract as `POST /api/v1/auth/login`.

curl -X POST "https://example.com/api/v2/auth/login" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com",    "password": "string"  }'