Feature Request: Support Custom Prefix for Refresh Tokens to Distinguish Token Types Easily

**Is your feature request related to a problem? Please describe.**
I would like an easy way to determine if a token is a refresh token or another type of token (e.g., personal access token) by inspecting it directly. Currently, to know if a token is a refresh token, I need to send a request to Authentik and wait for a response. This adds unnecessary delay to authentication in setups where multiple token types are supported.

**Describe the solution you'd like**
Allow setting a custom prefix for refresh tokens (e.g., rf_). This would help me identify them immediately and avoid an extra round-trip to the server.

**Describe alternatives you've considered**
Sending a request to Authentik to validate the token and determine its type, but this adds latency.

**Additional context**
Using prefixes would simplify token handling in environments that support multiple authentication methods, like SSO (OpenID Connect) and personal access tokens.

No file, test, or entry point is named. First locate refresh-token issuance and configuration in the Authentik codebase, then determine how a configurable prefix could distinguish refresh tokens while preserving existing token handling; done means the prefix can be configured and the token type can be identified without a server request.

Written by the indexing model from the issue text.