5.4.0

Restructure
New Journal entries
Colour tabs update with wind

api/login.php

@@ -0,0 +1,21 @@
+<?php
+// POST { email, password } -> signs the user in.
+require __DIR__ . '/../lib/bootstrap.php';
+require_method('POST');
+
+$body     = json_body();
+$email    = strtolower(trim($body['email'] ?? ''));
+$password = (string)($body['password'] ?? '');
+
+$stmt = db()->prepare('SELECT id, password_hash FROM users WHERE email = ?');
+$stmt->execute([$email]);
+$user = $stmt->fetch();
+
+// Same message whether the email is unknown or the password is wrong -
+// don't let a login form confirm which emails have accounts.
+if (!$user || !password_verify($password, $user['password_hash'])) {
+    json_error('Incorrect email or password.', 401);
+}
+
+issue_session((int)$user['id']);
+json_out(['ok' => true, 'email' => $email]);