feat(auth): JWT refresh token rotation — Issue #804

[Prozaks]

Summary

Adds comprehensive tests for the JWT refresh token rotation implementation (Issue #804).

The core service was already implemented in src/auth/token-rotation.ts and src/routes/token-refresh.ts. This PR adds full test coverage.

What was tested

• issueTokenFamily — returns correctly shaped token pair, prisma.create called, audit event emitted
• rotateRefreshToken — success path issues new tokens and revokes old; not_found; family_compromised (reuse detection triggers family revocation); expired (absoluteExpiresAt / slidingExpiresAt)
• revokeToken — valid, already-revoked, and missing tokens
• revokeAllUserTokens — revokes all families, returns count
• listUserTokenFamilies — deduplicates by familyId
• pruneExpiredTokens — deletes tokens past either expiry
• Redis blacklist integration paths

Test results

Test Files  1 passed
     Tests  42 passed
  Duration  ~1.6s

Closes #804

[vercel]

@Prozaks is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Prozaks Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits