`login` posted the credentials as HTTP basic auth with no request body. The API takes them as JSON, answers basic auth with a 401, and the lane reported that back as "opensubtitles rejected the configured credentials" — for correct credentials. Search was unaffected and hid this: it authenticates with the Api-Key header alone and never logs in, so candidates were found and only the download failed. `mount_login` matched on method and path, so the mock answered a token to any request shape. It now matches the body. Closes #271 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>