fix

backend/app/api/auth.py

@@ -36,7 +36,13 @@ async def register(payload: UserRegister, db: AsyncSession = Depends(get_db_dep)
 
 @router.post("/login", response_model=TokenOut)
 async def login(payload: UserLogin, db: AsyncSession = Depends(get_db_dep)):
-    result = await db.execute(select(User).where(User.email == payload.email))
+    # Accept either email or username in the `login` field.
+    login_value = (payload.login or "").strip()
+    if not login_value:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="login_required")
+    result = await db.execute(
+        select(User).where((User.email == login_value) | (User.username == login_value))
+    )
     user = result.scalars().first()
     if not user or not verify_password(payload.password, user.hashed_password):
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid_credentials")