feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout

- auth/refresh.go: RefreshStore(Issue/Rotate/Revoke/RevokeAll/RevokeByUser), SHA-256哈希256-bit随机串, 单次旋转事务(并发重放fail-closed)
- 迁移0008_refresh_tokens(id/user_id/role/token_hash UNIQUE/expires_at/revoked_at + 索引)
- gateway: POST /v1/auth/refresh(旋转/续期) + /v1/auth/logout(单/全设备); login响应增refreshToken
- config: AUTH_REFRESH_TTL(720h)/AUTH_REFRESH_ROTATE_DISABLED; decode.go 支持time.Duration
- rotate-jwt成功后RevokeAll(响应refreshTokensRevoked), revoke-keys不动refresh
- 14测试+真实二进制e2e, build/vet/test绿+交叉编译
- Docs/api-client v0.25 + api-reference §2.3/2.4 同步

cmd/cyrene/wire.go

@@ -656,6 +656,17 @@ func (a *app) wireFrontend() error {
 		a.log.Warn("audit store unavailable, falling back to in-memory", "error", aerr)
 		auditStore = nil
 	}
+	// Opaque refresh tokens (B2) share the primary SQLite handle. A failure here
+	// degrades gracefully: login simply omits refreshToken and /auth/refresh
+	// reports not-configured, rather than failing the whole boot. The store is
+	// held as the interface so a constructor failure leaves it nil (a typed nil
+	// pointer in the interface would be non-nil and panic on first call).
+	var refreshStore gateway.RefreshGrantStore
+	if store, rerr := auth.NewRefreshStore(context.Background(), a.db, a.log); rerr != nil {
+		a.log.Warn("refresh token store unavailable", "error", rerr)
+	} else {
+		refreshStore = store
+	}
 	// a.history is built in wireAuxiliary so both the channel bridge (wireChannels)
 	// and the gateway share the same persistent store. History was a no-op dependency
 	// before the IM path, so nothing downstream depends on its creation order change.
@@ -674,6 +685,7 @@ func (a *app) wireFrontend() error {
 		Tasks:          a.tasks,
 		Automations:    a.automation,
 		Users:          apiKeys,
+		Refresh:        refreshStore,
 		Backthink:      a.backthink,
 		RAG:            ragStore,
 		LLM:            a.llm,