Authentication module: JWT + refresh tokens, login/logout, token revo…

[MaryammAli]

PR Description — Authentication Module with JWT, Refresh Tokens, and Token Revocation

Summary

This PR implements a secure authentication module using JWT access and refresh tokens, with support for login, logout, token refresh, and token revocation. It also adds password protection, login rate limiting, and account lockout mechanisms to strengthen authentication security.

Changes

• Added /auth/login endpoint for credential-based authentication.
• Added /auth/refresh endpoint for issuing new access tokens using valid refresh tokens.
• Added /auth/logout endpoint to revoke active refresh tokens.
• Implemented configurable JWT access and refresh-token expiration.
• Added secure password hashing using bcrypt/Argon2 with per-user salts.
• Implemented refresh-token revocation to prevent reuse of invalidated sessions.
• Added rate limiting for repeated login attempts.
• Added configurable account lockout after repeated failed authentication attempts.
• Added validation for invalid, expired, and revoked tokens.
• Added authentication documentation covering endpoints, configuration, and security considerations.

Testing

• Added unit and integration tests for successful and failed login attempts.
• Tested valid, expired, and invalid refresh tokens.
• Verified refresh-token revocation and logout behavior.
• Tested login rate limiting and account lockout scenarios.
• Verified password hashing and authentication failure handling.
• Tested configurable token expiration settings.
  Closes Authentication module: JWT + refresh tokens, login/logout, token revocation #373