[AUTH-004] Auth: JWT session management & token refresh

## Overview
Implement background token refresh so users stay logged in without re-authenticating, and handle session expiry gracefully.

## Acceptance Criteria
- [ ] Access token expires after 15 minutes
- [ ] Refresh token expires after 7 days (sliding window)
- [ ] Silent refresh: client requests new access token before expiry using the refresh token
- [ ] If refresh token is expired/invalid, redirect to login
- [ ] Revoke refresh token on explicit sign-out
- [ ] Support "Remember me" to extend refresh token to 30 days

## Technical Notes
Refresh logic should be centralized in an auth interceptor so all API calls benefit automatically.

## Depends On
- #5 AUTH-001 — access and refresh tokens issued there