Implement JWT refresh token flow for long-running uploads

[Copilot]

Access token expiry mid-upload caused abrupt 401 failures and lost progress. This adds a full refresh token flow with silent renewal, token rotation, and upload pause-on-auth-failure instead of hard abort.

Backend

• config.py: Two new required settings — REFRESH_TOKEN_SECRET_KEY (separate secret, strength-validated) and REFRESH_TOKEN_EXPIRE_DAYS (default 30)
• auth.py: create_refresh_token() / decode_refresh_token() using a dedicated secret; access and refresh tokens now carry a "type" claim; verify_token() rejects non-access tokens
• database.py: refresh_tokens_collection with TTL auto-expiry and unique hash index
• auth_routes.py:
  • POST /login — issues access token + HttpOnly refresh_token cookie; response includes expires_in
  • POST /refresh — verifies token against DB hash, rotates (deletes old, inserts new), returns new access token
  • POST /logout — revokes DB entry, clears cookie
• All datetime.utcnow() replaced with timezone-aware datetime.now(timezone.utc)

Frontend

• storage.js: storeAuthSession(token, expiresIn), getAccessToken(), getTokenExpiresAt(), clearAuthSession() — centralizes session state away from raw sessionStorage calls
• authApi.js: silentRefresh() with single-flight deduplication; 401-retry response interceptor skips /refresh and /login to avoid loops; logoutUser() calls backend before clearing local state
• uploadApi.js: withCredentials: true + same 401-retry interceptor wired to silentRefresh
• useChunkedUpload.js: Auth failures now attempt silentRefresh() then pause the upload instead of throwing to error state — progress is preserved, user can re-authenticate and resume
• App.jsx: Proactive refresh timer fires REFRESH_BEFORE_EXPIRY_MS (2 min) before token expiry; handleLogout calls logoutUser() + clearAuthSession(); auth error toast no longer forces logout when upload is paused

// silentRefresh — single-flight so concurrent callers share one request
let _refreshPromise = null;
export async function silentRefresh() {
  if (_refreshPromise) return _refreshPromise;
  _refreshPromise = api.post("/refresh")
    .then(({ data }) => { storeAuthSession(data.access_token, data.expires_in); return data.access_token; })
    .finally(() => { _refreshPromise = null; });
  return _refreshPromise;
}