# `POST /auth/login`

Public. No cookie required.

**Body (JSON)**

```json
{ "idToken": "<google-id-token>" }
```

**200**

```json
{
  "message": "Login successful",
  "user": { "id": 1, "email": "you@example.com", "picture": "https://lh3.googleusercontent.com/..." }
}
```

**Errors**

| Status | Body |
|--------|------|
| 400 | `{ "error": "idToken is required" }` or `{ "error": "GOOGLE_CLIENT_ID is not configured" }` |
| 401 | `{ "error": "Invalid Google token" }` or `{ "error": "Invalid Google account" }` |
| 403 | `{ "error": "Email is not authorized" }` |