ADMIN

Signs an administrator in with email and password. Multi-factor
authentication is mandatory, so a successful password check returns a
challenge rather than a session on all but the simplest path — answer it
at POST /admin/auth/challenge.

A first sign-in returns NEW_PASSWORD, then MFA_SETUP, before a session
is issued. Later sign-ins return MFA_CODE.

Rejects an unknown account and a wrong password identically, so the
endpoint cannot be used to discover whether an address has an account.

On success the refresh token is returned as an HttpOnly cookie rather
than in the body, so it is never readable by browser scripts. Send
requests with credentials included and keep the access token in memory
only.