Authenticate with an EIP-712 Login signature and receive JWT access and refresh tokens.

Prerequisites:

1. GET /v1/auth/nonce — a one-time nonce, returned as a hex string. Single use, expires after 5 minutes.
2. GET /v1/auth/eip712-domain — the same domain every other RISEx signature uses.

The account signs Login:

Login(address account,uint256 nonce,uint32 deadline)

The nonce is a hex string on the wire but is signed as a uint256, so parse it base-16 before signing.

Signature encoding: 0x-prefixed hex, as on register-signer and revoke-signer. This differs from permit.signature on the trading endpoints, which is base64.

Login itself needs no on-chain allowance — a freshly registered account can mint a token. The OperatorHub allowance gates trading with that token: a JWT order without one reverts with AllowanceExpired(address,address). Grant it with POST /v1/auth/approve-single, or use the permit flow, which has no such dependency.