Strict anti-enumeration: unknown email, wrong password, non-active account => INVALID_CREDENTIALS (401). If 2FA enabled: returns a challenge (no token). If 2FA disabled: issues a token (1 token per device_id).
Login success (token) OR 2FA challenge returned.