**Patch Plan**

| File | Function | Change |
|------|----------|--------|
| `store.py` | `get_user(email)` | Normalize the key the same way `save_user` does: `email.strip().lower()` |
| `routes.py` | `login(email, password_hash)` | No change needed once `get_user` is fixed, but add a comment explaining the dependency on normalization. |

**Exact code edits**

```diff
# store.py
def get_user(email):
-    return USERS.get(email)
+    # Normalise the lookup key to match the storage key
+    return USERS.get(email.strip().lower())
```

```diff
# routes.py
def login(email, password_hash):
-    stored = get_user(email)
+    # `get_user` already normalises the email, so we can pass it directly
+    stored = get_user(email)
     return stored == password_hash
```

**Regression test**

```python
# test_login_normalization.py
import pytest
from store import save_user, USERS
from routes import login

def test_login_email_normalization():
    # Arrange
    email = "User@Example.com"
    password_hash = "hashed_pwd"
    save_user(email, password_hash)

    # Act & Assert
    # Login with different case and surrounding whitespace
    assert login("  user@example.com  ", password_hash) is True

    # Wrong password should fail
    assert login("user@example.com", "wrong_hash") is False
```

This patch ensures that both storing and retrieving users use the same email normalization logic, fixing the login failure caused by inconsistent handling.