Homework — your account and token.

1. Register. Run the backend, "Sign up" with a new email → you should land on the menu. A new user appears in the backend (DB).
2. Log back in. Log out (logout()), then "Log in" with the same email and password → the menu again.
3. Persistence. While logged in, fully close the app and reopen it. StartupViewModel should find the token and go straight to the menu — no login form.
4. Look at the token. Copy the returned token and paste it into jwt.io. In the payload you'll see exp (expiry) and a user identifier. That's exactly what the server checks.

Required tests:

• Wrong-password test: enter the correct email, a wrong password → you see Error "Login failed", not a crash.
• Persistence test: after a restart you stay logged in.

To submit: screenshots: (1) the login screen, (2) the menu after login, (3) the token payload from jwt.io (never a real password!).

Next. We have the token stored securely — but we don't send it anywhere yet. In lesson 9 we add an OkHttp interceptor that attaches the token to every protected request: finally we can order (POST /orders) and see our history (GET /orders). And in 8b, Google sign-in yields the same token — the rest of the app doesn't change at all.