Review

Add JWT refresh support

Support automatic refresh tokens so mobile sessions survive access-token expiry.

FastAPITier 4securityauth

Click a line to flag it, pick one or more labels, then submit. If the change looks correct, approve it.

app/auth/tokens.py+13-0

55	55		@app.post("/token/refresh")
	56	+	def refresh_token(body: RefreshRequest):
	57	+	payload = jwt.decode(
	58	+	body.refresh_token,
	59	+	SECRET_KEY,
	60	+	algorithms=["HS256"],
	61	+	options={"verify_exp": False},
	62	+	)
	63	+	user_id = payload["sub"]
	64	+	access = create_access_token(user_id)
	65	+	return {
	66	+	"access_token": access,
	67	+	"refresh_token": body.refresh_token,
	68	+	}