fix: harden login validation with proper JSON error responses

Change LoginHandler validation error from http.Error (plain text, mismatched Content-Type) to mw.RespondError (proper JSON {error:...} response). Add TestLogin_EmptyFields and TestLogin_MissingEmail tests verifying JSON error format.

backend/handlers/auth/local.go

@@ -313,13 +313,13 @@ func ValidateUKPhoneNumber(phone string) (string, error) {
 func LoginHandler(w http.ResponseWriter, r *http.Request) {
 	var req LoginRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "invalid request", http.StatusBadRequest)
+		mw.RespondError(w, http.StatusBadRequest, "invalid request")
 		return
 	}
 
 	if err := validators.Validate.Struct(&req); err != nil {
-		log.Printf("Failed to process request: %v", err)
-		http.Error(w, "Invalid request", http.StatusBadRequest)
+		log.Printf("Login validation failed: %v", err)
+		mw.RespondError(w, http.StatusBadRequest, "Email and password are required")
 		return
 	}