feat: implement long-term user login with refresh tokens

- Introduced a dual-token system for user authentication: a short-lived access token and a long-lived rotating refresh token.
- Created a new RefreshToken model to manage refresh tokens securely.
- Updated auth_api.py to handle login, refresh, and logout processes with the new token system.
- Enhanced security measures including token rotation and theft detection.
- Updated frontend to handle token refresh on 401 errors and adjusted SSE authentication.
- Removed CORS middleware as it's unnecessary behind the nginx proxy.
- Added tests to ensure functionality and security of the new token system.

backend/db/db.py

@@ -78,6 +78,7 @@ tracking_events_path = os.path.join(base_dir, 'tracking_events.json')
 child_overrides_path = os.path.join(base_dir, 'child_overrides.json')
 chore_schedules_path = os.path.join(base_dir, 'chore_schedules.json')
 task_extensions_path = os.path.join(base_dir, 'task_extensions.json')
+refresh_tokens_path = os.path.join(base_dir, 'refresh_tokens.json')
 
 # Use separate TinyDB instances/files for each collection
 _child_db = TinyDB(child_path, indent=2)
@@ -91,6 +92,7 @@ _tracking_events_db = TinyDB(tracking_events_path, indent=2)
 _child_overrides_db = TinyDB(child_overrides_path, indent=2)
 _chore_schedules_db = TinyDB(chore_schedules_path, indent=2)
 _task_extensions_db = TinyDB(task_extensions_path, indent=2)
+_refresh_tokens_db = TinyDB(refresh_tokens_path, indent=2)
 
 # Expose table objects wrapped with locking
 child_db = LockedTable(_child_db)
@@ -104,6 +106,7 @@ tracking_events_db = LockedTable(_tracking_events_db)
 child_overrides_db = LockedTable(_child_overrides_db)
 chore_schedules_db = LockedTable(_chore_schedules_db)
 task_extensions_db = LockedTable(_task_extensions_db)
+refresh_tokens_db = LockedTable(_refresh_tokens_db)
 
 if os.environ.get('DB_ENV', 'prod') == 'test':
     child_db.truncate()
@@ -117,4 +120,5 @@ if os.environ.get('DB_ENV', 'prod') == 'test':
     child_overrides_db.truncate()
     chore_schedules_db.truncate()
     task_extensions_db.truncate()
+    refresh_tokens_db.truncate()