Tip: If you still see "Invalid email or password", confirm the user exists in users table and has a valid password_hash.