Embat Authentication API

`Authentication` provides the credentials Embat issues to access the rest of the public API. Every other endpoint requires a JWT `idToken` in the `Authorization: Bearer ` header; requests with no token, or with an invalid or expired one, are rejected with `401`.An `email`/`password` pair identifies a service user with access to a group of companies in Embat. Keep these credentials secret: never commit them to a repository, embed them in client-side code, or expose them in publicly accessible logs.**Typical flow:**1. Exchange your `email`/`password` for a bearer token:```jsonPOST /authentication/token{ "email": "erp-integration@acme-corp.com", "password": "your-service-password"}```which returns:```json{ "idToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjE5YzY4In0..." }```2. Send that token as `Authorization: Bearer ` on every subsequent request.3. The token expires **60 minutes** after issuance. Call `/authentication/token` again with the same credentials to get a new one; there is no separate refresh endpoint.4. Accounts with multi-factor authentication enabled cannot authenticate through this endpoint.5. If `email` or `password` is missing or malformed, the validation error response never echoes back the submitted values, so credentials are never reflected in error output.All requests must be made over **HTTPS**.