Login requires the WPGraphQL JWT Authentication plugin plus a secret key in WordPress wp-config.php:
define( 'GRAPHQL_JWT_AUTH_SECRET_KEY', 'paste-a-long-random-secret' );
Place it above /* That's all, stop editing! */. Generate a secret at api.wordpress.org/secret-key/1.1/salt.