Fix/issue 2339 secure token architecture

[Prateek2007-cmd]

Description

Resolves Issue #2339 (Long-lived Access Tokens & Missing Revocation) and natively remediates XSS Token Extraction vulnerabilities.

Previously, the authentication system issued 7-day long-lived access tokens and stored them in localStorage. This meant an XSS attack could easily steal the token, granting an attacker a full week of access with no ability for the user to revoke it.

This PR overhauls the token architecture to use short-lived access tokens and secure refresh tokens via HttpOnly cookies.

Changes Made

• Access + Refresh Tokens: Reduced access token TTL from 7 days to 15 minutes. Implemented a 7-day refresh token.
• HttpOnly Cookies: Refactored auth.py to issue tokens exclusively via HttpOnly, Secure, SameSite=Lax cookies, rendering them immune to JavaScript extraction (XSS).
• Session Revocation: Added a POST /api/auth/logout endpoint to instantly destroy the authentication cookies, properly terminating the session.
• Frontend Refactor: Purged insecure localStorage.setItem("token") usage from login.js and register.js.

Type of Change

• Security Fix
• Architectural Overhaul

[vercel]

@Prateek2007-cmd is attempting to deploy a commit to the janavipandole's projects Team on Vercel.

A member of the Team first needs to authorize it.