SSO Login: increase lifespan of JSON tokens for cookie-less auth

There are security issues with increasing the age of a JSON token as it is a key to access the API. They are meant to be short lived I think.

Something I read mentioned having a refresh token that you could use to request an issue of another auth token, but I'm not sure how that would work if you left a site for weeks before coming back to it.

> This will work for cookie based auth like on zume or DT, but PG uses JSON tokens, so we > would need to come up with another way of extending the life of those
> _Originally posted by @squigglybob in https://github.com/DiscipleTools/disciple-tools-theme/issues/2537#issuecomment-2236681460_