Username enumeration via differential login responses

Observable response discrepancy in ChurchCRM before 7.2.0 allows remote attackers to enumerate valid usernames through the public login API. The /api/public/user/login handler returns 404 when UserQuery finds no account but 401 when password validation fails for an existing account. The endpoint is unauthenticated and lacks rate limiting or lockout, so repeated requests disclose account existence and enable targeted password attacks without granting account access.