Cypress intercepts a POST request to /api/login.
It doesn’t block the request immediately — instead, it uses a callback to manipulate the response.
In this case, it fakes the login token in the reply.