feat(auth): rotate refresh token

[Besthope-Official]

Related Issue

Closes #96

Summary of Changes

• Implement refresh token rotation on /auth/jwt/refresh endpoint
• Old refresh token is invalidated on each refresh, new token issued alongside access token
• Remove unused AccessTokenResponse schema

Breaking Changes

• POST /auth/jwt/refresh response now includes refresh_token field (was access_token only)
• Clients must store and use the new refresh token for subsequent calls;

Checklist

• Issue discussion completed before opening PR
• Scope is small and focused (single feature/fix)
• All functions have full type annotations
• Async/await used for all I/O operations
• Tests added for new behaviors

Test plan

• test_refresh_token_rotation verifies old token returns 401 after rotation
• test_refresh_token_rotation verifies new token works (returns 200)