feat(security): refresh token revocation list

[MarkCesium]

Summary

Refresh tokens live 30 days and cannot be invalidated early. Logout only clears the access token on the client. A stolen refresh token gives an attacker a month of access.

Changes

• Redis key auth:revoked_refresh:{jti} with TTL = remaining lifetime of the token.
• backend/auth/src/services/auth.py — on Logout, on password change, and on DeleteUser, insert the jti of the user's active refresh tokens into the revocation set.
• RefreshTokens handler checks Redis before minting new access tokens.
• Prometheus counter auth_refresh_revoked_hit_total (see feat(observability): structured logging, metrics, tracing #10).

Verification

• Log in, capture refresh token, call /Logout.
• Attempt /RefreshTokens with the old refresh — returns UNAUTHENTICATED.
• Redis key present with TTL matching original expiry.