jwtMiddleware now rotates the access-token cookie proactively when
within PROACTIVE_REFRESH_MARGIN_SEC (15 min) of real expiry, using the
server's own clock. Removes the need for client-side exp comparison
(impossible anyway for httpOnly cookies). AuthPayload gains iat/exp
fields for callers that need to inspect token lifetime.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
extractToken now checks Authorization: Bearer before the accessToken cookie so
injected headers (Electron, API clients) cannot be shadowed by stale cookies.
JWT_CLOCK_TOLERANCE env var (seconds) is passed to jwt.verify as clockTolerance
when non-zero — set in .env for local dev to absorb clock skew vs production.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rokojori