Authenticate a member and receive a JWT access token plus refresh token. This endpoint is public. Send X-Trifft-ProjectId so the API can identify the project. The issued JWT includes a project claim, so later Touchpoint requests can omit that header.