feat(auth): refresh token 续期(B2) — 不透明哈希+单次旋转+/auth/refresh+/auth/logout

- auth/refresh.go: RefreshStore(Issue/Rotate/Revoke/RevokeAll/RevokeByUser), SHA-256哈希256-bit随机串, 单次旋转事务(并发重放fail-closed)
- 迁移0008_refresh_tokens(id/user_id/role/token_hash UNIQUE/expires_at/revoked_at + 索引)
- gateway: POST /v1/auth/refresh(旋转/续期) + /v1/auth/logout(单/全设备); login响应增refreshToken
- config: AUTH_REFRESH_TTL(720h)/AUTH_REFRESH_ROTATE_DISABLED; decode.go 支持time.Duration
- rotate-jwt成功后RevokeAll(响应refreshTokensRevoked), revoke-keys不动refresh
- 14测试+真实二进制e2e, build/vet/test绿+交叉编译
- Docs/api-client v0.25 + api-reference §2.3/2.4 同步

internal/auth/auth.go

@@ -45,6 +45,10 @@ var (
 	ErrUnauthorized = errors.New("auth: unauthorized")
 	// ErrForbidden reports a valid credential with insufficient privilege.
 	ErrForbidden = errors.New("auth: forbidden")
+	// ErrInvalidGrant reports an unknown, revoked, or expired refresh token.
+	ErrInvalidGrant = errors.New("auth: invalid refresh grant")
+	// ErrNilDB reports a nil *sql.DB passed to a store constructor.
+	ErrNilDB = errors.New("auth: nil database")
 )
 
 // Package-wide constants. `source` is the log provenance tag used by every