feat: implement long-term user login with refresh tokens

- Introduced a dual-token system for user authentication: a short-lived access token and a long-lived rotating refresh token.
- Created a new RefreshToken model to manage refresh tokens securely.
- Updated auth_api.py to handle login, refresh, and logout processes with the new token system.
- Enhanced security measures including token rotation and theft detection.
- Updated frontend to handle token refresh on 401 errors and adjusted SSE authentication.
- Removed CORS middleware as it's unnecessary behind the nginx proxy.
- Added tests to ensure functionality and security of the new token system.

.vscode/launch.json

@@ -9,7 +9,9 @@
       "python": "${command:python.interpreterPath}",
       "env": {
         "FLASK_APP": "backend/main.py",
-        "FLASK_DEBUG": "1"
+        "FLASK_DEBUG": "1",
+        "SECRET_KEY": "dev-secret-key-change-in-production",
+        "REFRESH_TOKEN_EXPIRY_DAYS": "90"
       },
       "args": [
         "run",