[Security] Implement JWT Token Expiration #15

Problem

Generated tokens have no expiration enforcement.

Impact

• Tokens valid indefinitely
• Compromised tokens never invalidated
• No automatic session expiration

Solution

Add JWT expiration:

• exp claim in token (1 hour default)
• Validation in auth middleware
• Refresh token support

Acceptance Criteria

• Tokens include exp claim
• Expired tokens rejected
• Refresh endpoint created
• Tests verify expiration