#43 Issue 43: [Security] JWT Token Refresh Rotation


Description:
For Admin sessions, access tokens should be short-lived (15 mins), relying on a secure, HTTP-only refresh token to maintain the session.
Acceptance Criteria:

[ ] Implement POST /api/auth/refresh.

[ ] Set strict SameSite=Strict; HttpOnly; Secure cookies for the refresh token.

[ ] Invalidate the old refresh token upon rotation.
Labels: security, auth