Log in a tenant user
No auth required to call. Verifies workspace slug + email + password against that tenant’s own schema. Returns 401 if the tenant is not lifecycle_state == "live" or the credentials do not match — the response deliberately does not distinguish an unknown workspace from a wrong password. Rate-limited per client IP and per (tenant, email) pair; 429 with Retry-After on excess attempts. On success, creates a user_sessions row (tenant schema) and sets the httpOnly cl_tenant_session cookie (value "<workspace-slug>:<token>", 24-hour lifetime) plus a fresh cl_csrf cookie. Implemented in services/api/auth_api.py and services/api/auth/tenant_auth.py.