1## ADDED Requirements23### Requirement: Password login4The system SHALL authenticate users with an email address and password, storing only argon2id password hashes.56#### Scenario: Valid credentials7- **WHEN** a user submits a registered email and the correct password8- **THEN** the system creates a session and sets an `HttpOnly`, `Secure` session cookie9- **AND** redirects the user to their last visited project1011#### Scenario: Invalid credentials12- **WHEN** a user submits an unknown email or a wrong password13- **THEN** the system responds with the generic message "Invalid email or password"14- **AND** does not reveal which field was wrong1516### Requirement: Session expiry17Sessions SHALL expire after 30 days without activity, after which the user MUST log in again.1819#### Scenario: Expired session20- **WHEN** a request arrives with a session cookie last used more than 30 days ago21- **THEN** the system deletes the session and redirects to the login page2223#### Scenario: Activity extends session24- **WHEN** a request arrives with a session last used 29 days ago25- **THEN** the request succeeds and the session's last-used time is updated2627### Requirement: Remember me28The login form SHALL offer a "Remember me" option that extends the session inactivity timeout to 90 days.2930#### Scenario: Remember me selected31- **WHEN** a user logs in with "Remember me" checked32- **THEN** the session inactivity timeout is 90 days instead of 303334### Requirement: Account lockout35The system MUST lock an account for 15 minutes after 5 consecutive failed login attempts.3637#### Scenario: Fifth failed attempt38- **WHEN** a user fails to log in 5 times in a row39- **THEN** further login attempts for that account are rejected for 15 minutes40- **AND** the response is indistinguishable from an invalid-credentials response4142#### Scenario: Successful login resets counter43- **WHEN** a user fails to log in 3 times and then logs in successfully44- **THEN** the failed-attempt counter resets to zero