Rotating refresh tokens: Why critical in authorization

A walk through a real Go + Postgres session layer — short-lived access JWTs, opaque rotating refresh tokens stored only as hashes, and the reuse case that rotation still leaves on the table.