feat: implement JWT token blacklist and refresh token endpoint

[Ibinola]

Summary

• Added jti (JWT ID) claim to access tokens using uuid
• Created TokenBlacklistService with Redis-backed storage for token revocation
• Blacklist access token jti on logout with TTL matching remaining token lifetime
• Updated JwtStrategy to check Redis blacklist before validating tokens
• Issued long-lived refresh tokens on login and register
• Added POST /api/auth/refresh endpoint for token rotation
• Refresh tokens transmitted via httpOnly cookie (not response body)
• Invalidate refresh token on logout and clear cookie
• Refresh token validation with revocation support
• Added moduleNameMapper for src/ path alias in Jest config

Testing

• npm run build passes
• npm test passes (10/10 tests)
• Unit tests cover: token blacklisting, refresh token rotation, revoked token rejection, logout flow

Acceptance Criteria

• Using a token after logout returns 401
• POST /api/auth/refresh with a valid refresh token returns a new access token
• Expired or tampered refresh tokens return 401
• Refresh token transmitted via httpOnly cookie (not response body)
• Integration tests cover: login -> logout -> use old token (401); login -> refresh -> use new token (200)

Closes #262