feat(auth): Add API token refresh for mobile/API clients (Vibe Kanban)

[jtomaszewski]

Summary

This PR adds header-based token refresh support for mobile and API clients, addressing the limitation where only browser-based cookie authentication could refresh tokens.

Changes

• POST /api/session/refresh - New endpoint for API/mobile clients

  • Accepts {"refreshToken": "..."} in JSON request body
  • Returns {"ok": true, "accessToken": "jwt...", "expiresIn": 28800}
  • Proper error responses: 400 for missing token, 401 for invalid/expired token
  • Also sets auth_token cookie for hybrid apps (e.g., mobile WebView)

• Login response extended - When remember=true, the response now includes the refreshToken field in the JSON body, allowing mobile/API clients to store and use it for token refresh

• Existing behavior preserved - GET /api/session/refresh continues to work for browser clients with cookie-based redirect flow

API Usage

Login (obtain refresh token):

curl -X POST "$BASE_URL/api/login" \
  -d "email=user@example.com" \
  -d "password=secret" \
  -d "remember=1"
# Response: {"ok": true, "token": "jwt...", "refreshToken": "abc123...", "redirect": "/backend"}

Refresh (API clients):

curl -X POST "$BASE_URL/api/session/refresh" \
  -H "Content-Type: application/json" \
  -d '{"refreshToken": "abc123..."}'
# Response: {"ok": true, "accessToken": "new-jwt...", "expiresIn": 28800}

Test Plan

• Integration tests added (TC-AUTH-017)
  • Login with remember=true returns refreshToken
  • Login without remember does not return refreshToken
  • POST refresh returns new accessToken for valid token
  • POST refresh returns 400 for missing token
  • POST refresh returns 401 for invalid token
  • New access token can be used for authenticated requests
• Build passes
• OpenAPI documentation updated

Closes open-mercato#613

---

This PR was written using Vibe Kanban