Rotating refresh tokens with reuse detection in Spring Boot 4 (no extra JWT library)

Short-lived JWTs, opaque hashed refresh tokens, and what to do when an old token shows up again.