## 27) Error response body shape is inconsistent

backend/app/routers/auth.py

@@ -22,7 +22,7 @@ from __future__ import annotations
 import asyncio
 
 import structlog
-from fastapi import APIRouter, HTTPException, Request, Response, status
+from fastapi import APIRouter, Request, Response, status
 
 from app.dependencies import (
     AuthDep,
@@ -31,6 +31,7 @@ from app.dependencies import (
     SessionServiceContextDep,
     SettingsDep,
 )
+from app.exceptions import AuthenticationError, RateLimitError
 from app.models.auth import LoginRequest, LoginResponse, LogoutResponse
 from app.services import auth_service
 from app.utils.client_ip import get_client_ip
@@ -79,18 +80,14 @@ async def login(
         :class:`~app.models.auth.LoginResponse` containing the token.
 
     Raises:
-        HTTPException: 401 if the password is incorrect.
-        HTTPException: 429 if the rate limit is exceeded.
+        AuthenticationError: if the password is incorrect.
+        RateLimitError: if the rate limit is exceeded.
     """
     client_ip = get_client_ip(request, trusted_proxies=_TRUSTED_PROXIES)
 
     if not rate_limiter.is_allowed(client_ip):
         log.warning("login_rate_limit_exceeded", client_ip=client_ip)
-        raise HTTPException(
-            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-            detail="Too many login attempts. Please try again later.",
-            headers={"Retry-After": "60"},
-        )
+        raise RateLimitError("Too many login attempts. Please try again later.")
 
     try:
         signed_token, expires_at = await auth_service.login(
@@ -106,10 +103,7 @@ async def login(
         # but an extra 10 seconds makes automation much less feasible.
         await asyncio.sleep(10.0)
         log.warning("login_failed", client_ip=client_ip, error=str(exc))
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=str(exc),
-        ) from exc
+        raise AuthenticationError(str(exc)) from exc
 
     response.set_cookie(
         key=SESSION_COOKIE_NAME,