[DJAngel973]

Summary

Implements SEC-004 refresh-token rotation to prevent refresh-token replay.

• Returns a new access token and refresh token on every successful refresh.
• Revokes the previous refresh-token session atomically.
• Uses pessimistic locking so concurrent requests cannot both consume the same refresh token.
• Adds a unique JWT jti to guarantee newly generated tokens are distinct.
• Audits successgul refreshes and rejected reuse attempts without logging raw tokens or hashes.
• Adds the TOKEN_REFRESH audit action and PostgreSQL migtration.

Security

• Refresh tokens remain stored only as SHA-256 hashes.
• Reused, revoked, or expired refresh tokens are rejected.
• Session rotation is transactional to prevent inconsistent token state.
• Audit records include outcome, IP, and User-Agent, never token values.

Tests

• Updated AuthServiceTest for successful rotation and rejected token reuse.
• Added SessionServiceTest coverage for session rotation and consumed-token rejection.

Follow-up

• Apply database/08-migrations.sql and perform Docker/PostgreSQL end-to-end verification of rotation, replay rejection, and logout.