Update Swagger specs to include login and registration

[jsfan]

The specs are currently written with the assumption that a third-party service takes care of authentication and session management while the API itself only verifies a JWT. As the app is now meant to take care of authentication itself, it needs to allow for a login using username and password (and possibly also a second factor for MFA) and issue a JWT on successful login.

As JWTs cannot be invalidated, we don't need to have a logout. The app will log the user out by deleting its copy of the JWT.