Figure out jwt refresh token

Right now the jwt expires after a set time (8 hour default) and forces the user to re-authenticate, which I think is an acceptable balance between security and user experience.

The security concern is that if a jwt is leaked somehow, the individual that has the compromised jwt now has up to 8 hours to do harm.

I would like to be able to implement some type of refresh token system where the access token is valid for only a short time (maybe 30 minutes), then a refresh token would be sent back to the api to extend the jwt another 30 minutes.

I personally need to do a bit more research on the topic, but certainly welcome anyone with experience to provide input.

該 payload 未指出任何檔案、測試或驗證入口點；首先定位目前 JWT 的簽發與過期處理。先定義存取權杖與更新權杖的生命週期以及安全性要求，然後在約定的行為完成實作並由相關測試涵蓋後，視為工作完成。

由索引模型根據 Issue 內容生成。