Stage 44 — API token refresh
Adds one-time rotating refresh tokens. Login now returns an access token plus a 7-day refresh token. POST /api/v1/auth/refresh/ exchanges a valid refresh token for a new access+refresh pair and consumes the old refresh token. Refresh tokens are stored in the server temp directory; no database changes or SQL import are required.
