Figure out jwt refresh token

Right now the jwt expires after a set time (8 hour default) and forces the user to re-authenticate, which I think is an acceptable balance between security and user experience.

The security concern is that if a jwt is leaked somehow, the individual that has the compromised jwt now has up to 8 hours to do harm.

I would like to be able to implement some type of refresh token system where the access token is valid for only a short time (maybe 30 minutes), then a refresh token would be sent back to the api to extend the jwt another 30 minutes.

I personally need to do a bit more research on the topic, but certainly welcome anyone with experience to provide input.

The payload names no files, tests, or authentication entry points; begin by locating the current JWT issuance and expiration handling. Define the access- and refresh-token lifecycle and security expectations first, then consider the work complete when the agreed behavior is implemented and covered by relevant tests.

Rédigé par le modèle d'indexation à partir du texte de l'issue.