feat: implement long-term user login with refresh tokens

- Introduced a dual-token system for user authentication: a short-lived access token and a long-lived rotating refresh token.
- Created a new RefreshToken model to manage refresh tokens securely.
- Updated auth_api.py to handle login, refresh, and logout processes with the new token system.
- Enhanced security measures including token rotation and theft detection.
- Updated frontend to handle token refresh on 401 errors and adjusted SSE authentication.
- Removed CORS middleware as it's unnecessary behind the nginx proxy.
- Added tests to ensure functionality and security of the new token system.

backend/api/user_api.py

@@ -21,7 +21,7 @@ user_api = Blueprint('user_api', __name__)
 UserQuery = Query()
 
 def get_current_user():
-    token = request.cookies.get('token')
+    token = request.cookies.get('access_token')
     if not token:
         return None
     try: