Log a storefront customer in

Authenticates by email plus password and issues a stateless session token. Any failure (unknown email, an unclaimed guest row with no password, a wrong password, or an unverified row) returns ONE uniform 401 with no field-level oracle, and every branch does an equal amount of scrypt work so there is no response-time side channel (no user enumeration). A booking the buyer makes while signed in appears in `me` right away. `me`'s retro-link inbox-control gate (a guest booking merely tied to the email stays hidden until the email is verified) is now unreachable from a login-issued session, since this method refuses an unverified row; it stays as defense in depth. Behind the publishable key, the `customer_accounts` flag, and the customer-auth rate-limit bucket. Five failures for one `(site, email)` pair add a 15-minute account-scoped backoff without affecting another site or email. Returns 200 with `{ customer, token }`. > **Note:** This endpoint requires the e-commerce feature to be enabled on your site.