Não consigo logar. | Spring MVC: autenticação com Spring Security, API Rest e AJAX

Não estou conseguindo logar de maneira alguma.

Já tentei de diversas formas diferente e não vai de jeito nenhum.

Seguem abaixo os códigos:

WebSecurityConfig.java

package br.com.alura.moodi;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeRequests()
                .anyRequest().authenticated()
        .and()
        .formLogin(form -> form
            .loginPage("/login")
            .defaultSuccessUrl("/home", true)
            .permitAll()
        )
        .logout(logout -> logout.logoutUrl("/logout"))
        .csrf().disable();
    }

    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        UserDetails user =
                User.withDefaultPasswordEncoder()
                .username("iago")
                .password("iago")
                .roles("ADM")
                .build();
        return new InMemoryUserDetailsManager(user);
    }
}

LoginController.java

package br.com.alura.moodi.controller;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class LoginController {

    @GetMapping
    @RequestMapping("/login")
    public String login(){
        return "login";
    }
}

<!DOCTYPE html>
<html lang="pt-br" xmlns:th="http://www.w3.org/1999/xhtml">
    <head th:insert="~{base :: head('Login')}"> </head>
    <body>
        <div th:replace="~{base :: logo}"> </div>

        <div class="container">
            <div th:replace="~{base :: jumbotron('Login')}"> </div>

            <div class="card mb-3">
                <form  action="@{/login}" class="card-body" method="post">
                    <div class="form-group mb-3">
                        <label for="username"> Nome de usuário: </label>
                        <input name="username" class="form-control" placeholder="Nome de usuário" type="text"/>
                    </div>
                    <div class="form-group mb-3">
                        <label for="password"> Senha: </label>
                        <input name="password" class="form-control" placeholder="Senha" type="password"/>
                    </div>

                    <button class="btn btn-primary " type="submit">Entrar</button>
                </form>
            </div>
        </div>
    </body>
</html>

base.html


<head th:fragment="head(valor)">
    <meta charset="UTF-8">
    <title th:text="${valor}"></title>
    <style>
        .logo-container{
            background-color: #47bcff;
            color: #ffffff;
        }
    </style>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.0/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-KyZXEAg3QhqLMpG8r+8fhAXLRk2vvoC2f3B09zVXn8CA5QIVfZOJ3BCsw2P0p/We" crossorigin="anonymous">
</head>

<div th:fragment="logo" class="logo-container mb-3 p-3 d-flex justify-content-between">
    <span>Moodi</span>
    <span>
        <a class="text-light" sec:authorize="!isAuthenticated()" href="/login">login</a>
        <a onclick="document.querySelector('#form-login').submit()" class="text-light" sec:authorize="isAuthenticated()" href="#">logout</a>
        <form id="form-login" th:action="@{/logout}" method="post"></form>
    </span>
</div>

<div th:fragment="jumbotron(valor)" class="jumbotron jumbotron-fluid bg-secondary p-5">
    <div class="container">
        <h1 th:text="${valor}" class="display-4"> </h1>
    </div>
</div>