security: prevent re-use of refresh token (reduce surface for any stolen token)

Security: session hardening

  Refresh token rotation with theft detection (family_id)
  - Added family_id column to auth.sessions (migration 20260507000000_session_family.sql) grouping all tokens issued from the same login into a family
  - On refresh, the new session inherits the parent's family_id
  - If a revoked token is replayed (indicates the token was stolen after rotation), the entire family is immediately invalidated and a warning is logged — forcing re-authentication on all devices

  SameSite=Strict on refresh cookie
  - Access cookie stays SameSite=Lax (needed for top-level navigation)
  - Refresh cookie upgraded to SameSite=Strict — it is only ever used for explicit POST to /api/auth/refresh, never via cross-site navigation

  Refresh token TTL: 30 days → 7 days
  - With rotation, active sessions auto-renew and effectively never expire
  - Inactive sessions expire after 7 days instead of 30, reducing the theft window

src/common/config.rs

@@ -450,9 +450,9 @@ impl Default for AuthConfig {
             // to set OXICLOUD_JWT_SECRET in production. The from_env() method
             // will validate this and warn/panic if not configured.
             jwt_secret: String::new(),
-            access_token_expiry_secs: 3600,     // 1 hour
-            refresh_token_expiry_secs: 2592000, // 30 days
-            hash_memory_cost: 65536,            // 64 MiB
+            access_token_expiry_secs: 3600,    // 1 hour
+            refresh_token_expiry_secs: 604800, // 7 days — with rotation, active sessions auto-renew
+            hash_memory_cost: 65536,           // 64 MiB
             hash_time_cost: 3,
             hash_parallelism: 2,
             rate_limit: RateLimitConfig::default(),