v0.1.16

Summary

• Add RefreshToken model with JTI tracking in the private schema for server-side refresh token validation
• Implement token rotation: each refresh token use revokes the old token and issues a new one
• Add reuse detection: replaying a revoked token revokes ALL tokens for that account (signals theft)
• Logout now revokes the refresh token server-side, not just deleting the cookie
• Email update flow revokes all old refresh tokens before issuing new ones
• Legacy tokens without JTI (pre-migration) are gracefully rejected, forcing re-login
• Fix misleading "new email address" text in email update form to correctly say "current email address"

Test plan

• 7 new integration tests covering all security flows (register/login token creation, logout revocation, token rotation, reuse detection, legacy rejection, automatic dependency refresh)
• Updated existing unit tests for new JTI-aware token API
• All 298 tests pass (291 existing + 7 new)
• Manual testing of register, login, logout, and email update flows

Closes #81

🤖 Generated with Claude Code