Add session management and token lifecycle review

[barry01-hash]

Review session management: token expiration, refresh token rotation, secure cookie flags (HttpOnly, Secure, SameSite), logout token invalidation, and concurrent session handling.