feat(security): HttpOnly cookie sessions, token revocation, and RBAC

- Add User.role (enum Role/ADMIN) and User.tokenVersion with migration
- Login now issues short-lived access token (30m default) + 7d refresh
  token, both embedding tokenVersion and a typ discriminator
- Tokens delivered via HttpOnly SameSite cookies (ir_at, ir_rt scoped
  to /auth); refresh token never leaves the cookie
- New endpoints: POST /auth/refresh (rotation), GET /auth/me,
  POST /auth/logout (bumps tokenVersion, revoking all tokens)
- JWT strategy accepts bearer or cookie, rejects refresh tokens, and
  verifies tokenVersion + user existence on every request
- Global RolesGuard: authenticated routes require ADMIN unless widened
  via @Roles(...)
- Admin SPA: session fully cookie-based, no token in localStorage;
  router guard restores session via /auth/me; axios auto-refreshes once
  on 401; stale localStorage keys cleaned up

apps/api/.env.example

@@ -5,8 +5,11 @@ DATABASE_URL=postgresql://postgres:CHANGE_ME@localhost:5432/inkreach-official-we
 # Must be at least 32 characters.
 JWT_SECRET=CHANGE_ME_TO_A_STRONG_RANDOM_SECRET
 
-# Access token lifetime (jwt-rest compatible, e.g. 30m, 12h, 7d)
-TOKEN_EXPIRES_IN=7d
+# Access token lifetime (e.g. 30m, 12h); short-lived, rotated via /auth/refresh
+TOKEN_EXPIRES_IN=30m
+
+# Refresh token lifetime (HttpOnly cookie)
+REFRESH_TOKEN_EXPIRES_IN=7d
 
 # Comma-separated list of allowed CORS origins (leave empty to disable CORS)
 CORS_ORIGINS=http://localhost:5173