feat: JWT auth — register, login, refresh tokens, logout

[Ali7040]

Implement AuthModule with:

• POST /auth/register — email + password, returns access + refresh tokens
• POST /auth/login — local strategy via passport-local.
• POST /auth/refresh — verify refresh token from httpOnly cookie, issue new pair
• POST /auth/logout — delete refresh token from DB
• JwtStrategy for @UseGuards(JwtAuthGuard) on protected routes
• Passwords hashed with bcryptjs (12 rounds)
• Refresh tokens stored in refresh_tokens table with expiry

Acceptance criteria:

• Access token expires in 15m, refresh token in 7d
• Replay attack: using a consumed refresh token returns 401
• GET /auth/me returns the current user profile