docs(auth): document 7-day session authentication with constants

- Add comprehensive authentication overview.md explaining:
  - 7-day session duration for JWT and refresh tokens
  - Constants-based implementation (no hardcoded values)
  - Complete authentication flow (register/login/refresh/logout)
  - Session expiration handling (HTML redirect vs JSON error)
  - Security features (HTTP-only cookies, token rotation)
  - Token storage recommendations
- Update login.md with 7-day expires_in field and cookie MaxAge
- Update register.md with 7-day session duration details
- Update refresh_token.md with expires_in: 604800

Documentation provides complete reference for authentication
endpoints with examples and security considerations.

docs/developer/api/authentication/refresh_token.md

@@ -1,6 +1,6 @@
 # Refresh Token
 
-Obtain a new JWT token using a refresh token.
+Obtain a new JWT access token using a refresh token.
 
 **Endpoint**: `POST /api/auth/refresh`
 **Auth**: Not required (uses refresh token)
@@ -10,7 +10,7 @@ Obtain a new JWT token using a refresh token.
 
 | Field | Type | Required | Description |
 |--------|------|-----------|-------------|
-| refresh_token | string | Yes | Valid refresh token |
+| refresh_token | string | Yes | Valid refresh token (UUID) |
 
 ### Example Request
 
@@ -24,14 +24,19 @@ Obtain a new JWT token using a refresh token.
 
 ```json
 {
-  "token": "new-jwt-token",
-  "refresh_token": "new-refresh-token"
+  "access_token": "new-jwt-token",
+  "token_type": "Bearer",
+  "expires_in": 604800
 }
 ```
 
+**Session Duration**: 7 days (604800 seconds)
+
+The new access token is valid for 7 days from the time of refresh.
+
 ## Error Responses
 
 | Code | Description |
 |------|-------------|
 | 401 | Invalid or expired refresh token |
-| 400 | Missing refresh token |
+| 400 | Missing refresh token or invalid format |