Refresh tokens in a .NET 10 Minimal API: rotation, reuse detection and revocation

Adding refresh tokens to a Minimal API starter: hashed storage, one-time rotation, token families to detect reuse, logout, and the mistakes I made along the way.