Add refresh-tokens module: JWT refresh token rotation, token families and reuse detection on Spring Security 7.1

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_017ic4b6XzpJxZ25cDyuw1Uk

refresh-tokens/output/07-logout.txt

@@ -0,0 +1,11 @@
+alice is logged in on phone, laptop and tablet (3 families); bob on one device.
+POST /api/auth/logout with the phone's refresh token: HTTP 204
+  phone refresh:  HTTP 401
+  laptop refresh: HTTP 200
+POST /api/auth/logout with a made-up token:           HTTP 204 (same answer, no oracle)
+POST /api/auth/logout-all with the laptop's access token: HTTP 200 {"revoked_tokens":3}
+  laptop refresh: HTTP 401
+  tablet refresh: HTTP 401
+  bob refresh:    HTTP 200 (untouched)
+alice's laptop ACCESS token on /api/me after logout-all: HTTP 200
+  (it is a signed JWT with 5 minutes left; nothing in the request path asked the store)