Add refresh tokens + revocation to Auth (#164)

[gregwinn]

Summary

Adds refresh tokens with rotation + revocation to the Auth module — sub-issue C (#164) of the authentication epic (#161), building directly on #163. Branches off develop (which now has #163 via #177), so no stacking issues this time.

match Auth.login(email, password)
  ok r => r   # %{user, access_token, refresh_token}
end
Auth.refresh(refresh_token)  # -> %{access_token, refresh_token} (rotated) | {:error, :invalid_token}
Auth.logout(refresh_token)   # -> :ok (idempotent)

Design

• login/2 now returns %{user, access_token, refresh_token}.
• refresh/1 looks the token up by hash, and if unexpired rotates it (old row deleted = single-use), returning a fresh access+refresh pair. Expired / unknown / already-rotated → :invalid_token.
• logout/1 deletes the token row; idempotent.
• Refresh tokens are opaque 32-byte random values; only the SHA-256 hash is stored in an auth_tokens table, so a DB leak doesn't expose live sessions. (SHA-256, not PBKDF2 — the token is already high-entropy, and a fast hash keeps lookup a single indexed query.)
• Revocation = row deletion, which works cleanly now that Repo.insert/get/update return misaligned maps — row_to_map ignores DB column order (drops a field, no id) #172 makes Repo records carry id.
• New config: auth.token_schema (default auth_token), auth.refresh_token_ttl (default 30d).

Testing

• 6 new tests: login-returns-refresh, rotate-and-invalidate-old, logout-revokes (+ idempotent), expired-token, unknown-token, and an e2e codegen-resolution test for Auth.refresh. 18/18 auth tests pass.
• Fake repo gained delete/1 and a monotonic id counter (so rotation can't hit an id collision).
• Full suite: 740 tests, only the pre-existing winn_sqlite_tests esqlite-NIF environmental failure.

Docs

• docs/modules.md: AuthToken schema + auth_tokens migration, Auth.refresh/Auth.logout sections, updated router + JS example (silent-refresh-on-401, logout).
• docs/stdlib.md + CHANGELOG updated.

Part of #161. Closes #164 once merged.

🤖 Generated with Claude Code