Implement JWT-based authentication with refresh token rotation

The app currently has no token-based auth — login just navigates to `/notes` with a username in router state. This means any user can access `/notes` directly without logging in.

Backend:
- Add Spring Security with JWT to `pom.xml`
- Issue a short-lived access token and a long-lived refresh token on login
- Add `POST /auth/refresh` endpoint
- Protect all `/notes` endpoints with JWT validation

Frontend:
- Store access token in memory and refresh token in an `httpOnly` cookie
- Add an Axios response interceptor in `api.js` that retries on `401` after refreshing the token
- Redirect to login if refresh also fails

Start by inspecting pom.xml, the existing login flow, the /auth and /notes endpoints, and api.js to map the current authentication behavior. Verify the backend and frontend token flows together, including refresh failures and direct access to /notes; done means protected notes endpoints, rotating refresh tokens, automatic 401 recovery, and redirect on failed refresh.

Written by the indexing model from the issue text.