Thanks a lot, it works great and unblocked me !

See for example https://github.com/odoo/odoo/blob/18.0/addons/auth_signup/controllers/main.py#L173

    def _signup_with_values(self, token, values):
        login, password = request.env['res.users'].sudo().signup(values, token)
        request.env.cr.commit()     # as authenticate will use its own cursor we need to commit the current transaction
        credential = {'login': login, 'password': password, 'type': 'password'}
        request.session.authenticate(request.db, credential)

In other words, login and password aren't individual arguments but have to be combined into a dictionary.

You seem to be mixing it with the authenticate() method of the /web/session/authenticate route - this one indeed would be expecting db, login, password as individual arguments.

About 'takes x positional arguments but y were given':

Simply put, 'y' would always be +1 since self is also there. A more common example would be the create method:
It's defined as create(self, vals_list), however, when using it, you would do so by calling model.create(vals_list), omitting self - since model is self already.