[70] [Backend] Create refresh token rotation service

[Goodnessukaigwe]

Closes #70

Summary

• Adds a refresh token rotation service that exchanges a valid refresh token for a new access/refresh pair.
• Each login starts a token family at generation 1; every successful rotation keeps the same family and increments the generation.
• The previous refresh token is hashed, persisted, and marked consumed so it cannot be replayed.
• Reuse of an already-consumed (or unknown-but-signed) refresh token is treated as a compromise: the entire family is revoked and no new pair is issued.
• Stellar and Google login now return both tokens; POST /auth/refresh handles the exchange. Refresh JWTs cannot be used as access tokens.

Tests

• Successful refresh and new pair issuance
• Token rotation, family/generation tracking, and previous-token invalidation
• Reused-token detection, concurrent consume, and compromised-family revocation
• Access-token-as-refresh rejection and refresh-token-as-access rejection

Made with Cursor

[drips-wave]

@Goodnessukaigwe Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits