Changeset 0.28.3 (#187)

docs/ICD/auth.md

@@ -22,9 +22,15 @@ POST /auth/register
 }
 ```
 
-Gated by `allow_registration` policy. Returns same shape as Login.
-A unique `handle` is auto-generated from `username` (collision-safe
-with `-2`, `-3` suffixes).
+Gated by `allow_registration` policy. A unique `handle` is
+auto-generated from `username` (collision-safe with `-2`, `-3` suffixes).
+
+**Response (201):** Same token shape as Login. If the user requires admin
+approval (`is_active` = false), returns `201` with:
+
+```json
+{ "message": "Account created but requires admin approval", "user_id": "uuid" }
+```
 
 ### Login
 
@@ -36,12 +42,14 @@ POST /auth/login
 { "username": "jdoe", "password": "..." }
 ```
 
-**Response:**
+**Response (200):**
 
 ```json
 {
   "access_token": "eyJ...",
   "refresh_token": "opaque-string",
+  "token_type": "Bearer",
+  "expires_in": 900,
   "user": {
     "id": "uuid",
     "username": "jdoe",
@@ -49,10 +57,7 @@ POST /auth/login
     "display_name": "Jane Doe",
     "handle": "jdoe",
     "role": "user",
-    "auth_source": "builtin",
-    "avatar_url": "/api/v1/profile/avatar?v=1234",
-    "created_at": "...",
-    "last_login": "..."
+    "auth_source": "builtin"
   }
 }
 ```