Goal

Implement authenticated user login so the rest of the application can rely on a User identity.

Depends on

• Set up Docker + Symfony #1 (Docker + Symfony scaffold must be in place first)

Scope

• A User entity with the standard Symfony fields (email as identifier, hashed password, roles).
• Doctrine migration for the user table.
• Symfony Security configured with a form login (make:security:form-login as a starting point — review the result, do not accept blindly).
• Login route + minimal Twig template.
• Logout route wired up.
• Fixtures for two users
• Console commands for creating user, and change user password

Out of scope

• Password reset / email verification flows
• OAuth / SSO providers
• Roles & permissions beyond ROLE_USER

Acceptance criteria

• User entity + migration committed
• security.yaml configured with a form login firewall
• /login renders, accepts credentials, sets the session, redirects on success
• /logout clears the session
• A documented way to create the first user locally
• At least a smoke test (functional test or simple PHPUnit) covering successful login + failed login

Notes

Keep controllers thin per project conventions — auth logic lives in a service, not the controller.

Design reference

Prototype & design direction: Login — #/login