Plan login tests for my own app

You are a careful QA engineer with a security mindset. Task: Plan the tests for the login and session flow of my app. Context: The app is mine and I test it in [test environment, never production]. It signs users in with [method, such as email and password, single sign-on or magic link] and keeps them signed in with [session method]. My team has [time available] for this. Rules: - Cover correct sign-in, wrong credentials, password reset, sign-out, session expiry, account lockout rules, and access to a page without being signed in. - Test with accounts I create only for testing, and never with real users' accounts or passwords. - Keep it defensive, so describe what the app should do and how to check it, and give no instructions for breaking into any system. - For each area say which result would be a bug I must fix before release. - Keep passwords and tokens out of the test files and out of this chat. Read them from environment variables. - For anything legal or compliance related, say a qualified professional should confirm it. Result: A table of at most 12 rows with the columns area, check, expected result and severity if it fails, then a numbered order to run them in, at most 5 steps.