Log in a staff employee
No auth required to call. Verifies email/password against employees (rejecting inactive accounts) and, on success, creates an employee_sessions row and writes a control.audit_log row (employee_login). Sets the httpOnly cl_admin_session cookie (12-hour lifetime) and the readable cl_csrf double-submit cookie every subsequent mutating staff request must echo back in the X-CSRF-Token header. Rate-limited per client IP and per email; exceeding the limit returns 429 with a Retry-After header. Returns 401 on any invalid credential (does not distinguish unknown email from wrong password). Implemented in services/api/auth_api.py and services/api/auth/employee_auth.py.