Choose a password and complete sign-in when
POST /api/auth/login returns NEW_PASSWORD_REQUIRED.

Complete sign-in

1. Sign in through POST /api/auth/login and keep the returned session.
2. Send your email, chosen newPassword and that session to this endpoint.
3. Use the returned accessToken for protected API requests.

Send the session exactly as returned by sign-in. It is required;
Cognito rejects the response without it. The new password must meet
the Cognito user pool's password policy.

Account activation

On success, the account's status is set to ACTIVE, regardless of
its previous status, and tokens are returned without another challenge.
The user must exist in the platform and belong to a tenant, or the
request returns 401.