POST /api/register creates a new user and returns HTTP 201 with a JWT; POST /api/login with valid credentials returns HTTP 200 and a JWT; protected routes reject requests without a valid token (HTTP 401)