How to properly organize authentication in Go? (JWT, sessions, middleware)

Hello everyone! I'm a beginner Go developer writing my first REST API in pure Go (without frameworks like Gin or Echo). I'm stuck on the authentication question. I've read tons of articles, but everywhere they suggest different approaches: some use JWT, some use sessions with cookies, some use OAuth2 through third-party services. I'm completely confused. My task: make a simple notes API. User registers, logs in, gets a token, and then uses it to access protected endpoints. So far I've sketched out this primitive code for password verification in a handler: ```go func loginHandler(w http.ResponseWriter, r *http.Request) { // ... parsing JSON with login and password user, err := findUserByEmail(email) if err != nil || !checkPasswordHash(password, user.Hash) { http.Error(w, "