Ravens evidence — two server logs

auth.log is the authentication log; app.log is the application log. One IP brute-forces the admin
login (many failures, then one success). Find that attacker IP in auth.log, then find the same IP
in app.log: the token minted for its successful session is the flag. Format HTF{...}.