feat: implement refresh token rotation

[hashhhh-16]

Summary

Implements refresh token rotation for JWT-based authentication.

Changes Made

• Added refreshToken field to the User model for server-side refresh token tracking.
• Added JWT_REFRESH_SECRET configuration for refresh token signing and verification.
• Introduced helper functions to generate access and refresh tokens separately.
• Updated login flow to issue both access and refresh tokens.
• Added POST /auth/refresh endpoint.
• Implemented refresh token rotation by generating and storing a new refresh token on every successful refresh request.
• Invalidated stored refresh tokens during logout.
• Updated authentication-related tests to reflect the new token response structure.

Security Improvements

• Prevents reuse of old refresh tokens after a successful refresh.
• Ensures refresh tokens can be invalidated on logout.
• Adds server-side validation of refresh tokens before issuing new access tokens.
• Reduces the impact of refresh token leakage by rotating tokens after each use.

Testing

• Updated authentication test assertions for access token and refresh token responses.
• Verified controller and route syntax using:

node --check controllers/auth.controller.js
node --check routes/auth.routes.js

Related Issue

Closes #456

[vercel]

Someone is attempting to deploy a commit to the niharika-mente's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Aamod007]

LGTM