Authentication (Token, Session, JWT)

# Token Authentication Setup
# pip install djangorestframework
# INSTALLED_APPS = [..., 'rest_framework.authtoken']
# python manage.py migrate  # Creates token table

# Generate token for user
# from rest_framework.authtoken.models import Token
# token = Token.objects.create(user=user)
# # Client sends: Authorization: Token abc123...

# JWT Authentication (recommended)
# pip install djangorestframework-simplejwt
# settings.py
# REST_FRAMEWORK = {
#     'DEFAULT_AUTHENTICATION_CLASSES': [
#         'rest_framework_simplejwt.authentication.JWTAuthentication',
#     ],
# }

# from rest_framework_simplejwt.views import (
#     TokenObtainPairView, TokenRefreshView
# )
# urlpatterns = [
#     path('api/token/', TokenObtainPairView.as_view(), name='token_obtain'),
#     path('api/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
# ]

# Client flow:
# 1. POST /api/token/ {username, password} -> {access, refresh}
# 2. Use access token: Authorization: Bearer eyJ...
# 3. When expired: POST /api/token/refresh/ {refresh} -> {access}