Authentication

# 1. Sign in
curl -c cookies.txt -X POST https://api.denialbase.com/api/v1/auth/session \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"…"}'

# 2. Complete 2FA
curl -b cookies.txt -c cookies.txt -X POST https://api.denialbase.com/api/v1/auth/session/2fa \
  -H "Content-Type: application/json" \
  -d '{"code":"123456"}'

# 3. Call a protected endpoint
curl -b cookies.txt https://api.denialbase.com/api/v1/denials

// Browser automatically stores + sends the httpOnly cookie.
await fetch("https://api.denialbase.com/api/v1/auth/session", {
  method: "POST",
  credentials: "include",           // IMPORTANT
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email, password }),
});

// Subsequent requests:
await fetch("https://api.denialbase.com/api/v1/denials", {
  credentials: "include",
});