Spec
Implement signup, login and requireAuth in controllers/auth.js. Contracts are in the comments.
Available libraries: bcryptjs (hash, compare), jsonwebtoken (sign, verify), and the User model with a verify(password) method.
Security checklist the tests enforce: normalise emails, never leak hashes, same 401 message for "no user" and "wrong password" (no user enumeration), reject forged and expired tokens.