Authenticate with an EIP-712 Login signature and receive JWT access and refresh tokens.

Prerequisites:

1. GET /v1/auth/nonce — a one-time nonce, returned as a hex string. Single use, expires after 5 minutes.
2. GET /v1/auth/eip712-domain — the same domain every other RISEx signature uses.

account signs Login (or a registered session key signs on its behalf — see below):

Login(address account,uint256 nonce,uint32 deadline)

The nonce is a hex string on the wire but is signed as a uint256, so parse it base-16 before signing.

Signature encoding: 0x-prefixed hex, as on register-signer and revoke-signer. This differs from permit.signature on the trading endpoints, which is base64.

Smart-contract / WebAuthn accounts: if account cannot itself produce an ECDSA signature, register a session key via RegisterSigner first, then sign Login with that session key and pass its address as signer. The session key must be Active (see GetSessionKeyStatus); the issued JWT still identifies account, not signer.

Login itself needs no on-chain allowance — a freshly registered account can mint a token. The OperatorHub allowance gates trading with that token: a JWT order without one reverts with AllowanceExpired(address,address). Grant it with POST /v1/auth/approve-single, or use the permit flow, which has no such dependency.