feature: add task management

Removed email field from LoginResponse schema to prevent information leakage. The session_id should be the only identifier returned for authenticated sessions.

Security rationale:

• Prevents email enumeration attacks
• Reduces PII exposure in API responses
• Session ID is sufficient for subsequent authenticated requests

Updated auth.py to no longer include email in response payload. Updated schemas.py LoginResponse model and documentation.