Refresh session token

Re-mint the caller's login JWT before it expires (sliding session).

Only user login JWTs are refreshable; permissions and the must_change_password gate are re-read from the database at re-mint. Refusal modes: 401 session_expired once the original authentication is older than the absolute window (admin.auth.session_ttl_seconds), 401 invalid_credentials for deactivated users, non-user tokens, or opaque (non-JWT) credentials. Clients should then send the user back to login.