e174ed93a4
register() strips leading/trailing whitespace from the username before storing it; login() was not, so a user who typed " alice " at login would get a 401 even though their account existed as "alice". Now both handlers trim consistently. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>