Figure out jwt refresh token

Right now the jwt expires after a set time (8 hour default) and forces the user to re-authenticate, which I think is an acceptable balance between security and user experience.

The security concern is that if a jwt is leaked somehow, the individual that has the compromised jwt now has up to 8 hours to do harm.

I would like to be able to implement some type of refresh token system where the access token is valid for only a short time (maybe 30 minutes), then a refresh token would be sent back to the api to extend the jwt another 30 minutes.

I personally need to do a bit more research on the topic, but certainly welcome anyone with experience to provide input.

The payload names no files, tests, or authentication entry points; begin by locating the current JWT issuance and expiration handling. Define the access- and refresh-token lifecycle and security expectations first, then consider the work complete when the agreed behavior is implemented and covered by relevant tests.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.