Add stateless JWT refresh token mechanism

- New config: Controller.jwt_refresh_token_expire_minutes (default 30 days)
- New endpoint: POST /v3/access/users/refresh (public, unauthenticated)
- Login/authenticate responses now include refresh_token
- AuthService: _create_token helper, create_refresh_token, get_token_data
  now parses type claim (token_use) for token classification
- Security: refresh tokens rejected on HTTP + WebSocket access paths;
  /refresh strictly requires type=='refresh'
- Logout works for free via existing token_version mechanism
- Tests: 9 new TestRefreshToken cases, all passing; 34 existing tests
  still pass (no regressions)

gns3server/schemas/controller/tokens.py

@@ -22,12 +22,20 @@ class Token(BaseModel):
 
     access_token: str
     token_type: str
+    refresh_token: Optional[str] = None
 
 
 class TokenData(BaseModel):
 
     username: Optional[str] = None
     token_version: int = 0
+    token_use: str = "access"
+
+
+class RefreshTokenRequest(BaseModel):
+    """Schema for requesting a token refresh."""
+
+    refresh_token: str
 
 
 class ApiKeyCreate(BaseModel):