Authenticate with email and password against the VMS API. On success a 200 response contains JWT tokens (accessToken, idToken, refreshToken, expiresIn). Pass accessToken as Authorization: Bearer <token> on subsequent VMS API calls. When MFA or another challenge is required the response instead contains challengeName and session — complete it with POST /auth/login/challenge. The Cognito app client ID is resolved server-side and is never accepted from the caller. An MFA challenge is an expected step, not something to skip.