spec-driven-workflow

### Implementation for Task: Implement User Authentication Endpoint

**Diff:**
```diff
+ // src/controllers/authController.ts
+ export const loginUser = async (req: Request, res: Response) => {
+   const { email, password } = req.body;
+
+   // Validate input
+   if (!email || !password) {
+     return res.status(400).json({ error: 'Email and password are required' });
+   }
+
+   // Find user
+   const user = await User.findOne({ email });
+   if (!user) {
+     return res.status(401).json({ error: 'Invalid credentials' });
+   }
+
+   // Verify password
+   const isMatch = await bcrypt.compare(password, user.password);
+   if (!isMatch) {
+     return res.status(401).json({ error: 'Invalid credentials' });
+   }
+
+   // Generate token
+   const token = jwt.sign({ userId: user._id }, process.env.JWT_SECRET!, {
+     expiresIn: '1h',
+   });
+
+   res.json({ token });
+ };
```

**Validation Against Spec:**
✅ Implements POST /api/auth/login endpoint
✅ Requires email and password in request body
✅ Validates input presence
✅ Returns 400 for missing fields
✅ Uses bcrypt for password comparison
✅ Generates JWT token with 1h expiration
✅ Returns 401 for invalid credentials
✅ Returns 200 with token on success

**Test Results:**
```
✅ Valid credentials → 200 with token
✅ Missing email → 400 error
✅ Missing password → 400 error
✅ Invalid email → 401 error
✅ Invalid password → 401 error
```

**Questions/Deviations:**
1. Spec mentions rate limiting but not implemented - should we add this?
2. Password strength requirements not specified - implement basic check?

**Next Task Suggestion:**
Based on the spec's "Authentication" section, next would be implementing the token refresh endpoint.