Grace window: /api/auth/refresh no longer hard-401s on a concurrent
reuse of the same refresh token. RefreshToken gains usedAt/replacedBy;
markUsed() soft-deletes instead of hard-deleting; within REFRESH_GRACE_TTL
(10s) a second use of the same token resolves to the same replacement pair.
Fixes browser tabs racing the same single-use token on access-token expiry.
new-session: POST /api/auth/new-session (requireAuth-guarded) mints a
fresh independent token pair from an existing valid access token.
Used by Electron instances on startup to avoid the login screen when
another instance is already running (via session-heartbeat.json).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- trust proxy for correct IP behind nginx
- refresh token now set as httpOnly cookie alongside access token
- GET /api/auth/refresh-session for browser-based token refresh
- DELETE /api/auth/me with full cleanup of tokens and cookies
- rate limiting on login (10/15min) and register (5/hr)
- welcome email on registration (non-blocking)
- delete account UI on profile page with two-step confirm
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rokojori