feat(auth): refresh tokens + remember me

Backend: add refresh JWT (30d, token_type claim), POST /auth/refresh
endpoint (rotates token pair), remember_me on login, JWT_REFRESH_EXPIRY_DAYS
env var. Extractors now reject refresh tokens on protected routes.

Frontend: sessionStorage for non-remembered sessions, localStorage +
refresh token for remembered sessions. Transparent 401 recovery in
api.ts (retry once after refresh). Remember me checkbox on login page
with security note when checked.

k-tv-backend/api/src/state.rs

@@ -124,6 +124,7 @@ impl AppState {
                 config.jwt_issuer.clone(),
                 config.jwt_audience.clone(),
                 Some(config.jwt_expiry_hours),
+                Some(config.jwt_refresh_expiry_days),
                 config.is_production,
             )?;
             Some(Arc::new(JwtValidator::new(jwt_config)))