Feat/refresh token reuse detection

[Yentec]

Description

Refresh token reuse detection via chain revocation

Changes

• Added chainId (UUID) column + index to refresh_tokens with a two-step migration (temporary DEFAULT gen_random_uuid() for existing rows, then dropped)
• Updated createRefreshToken to accept chainId, added revokeChain method using a single updateMany (no loop)
• Split reuse detection from expiry check in refresh() — replayed token triggers revokeChain + logger.warn audit log before 401
  issueTokens generates a new chainId on login/register, preserves it on rotation
• Created docs/adr/0006-refresh-token-reuse-detection.md — documents the decision and the network-retry false-positive trade-off

Validation

• 38/38 tests pass
• Clean typecheck
• Clean lint
• Integration test: tokenA → tokenB → replay(tokenA) → 401 + tokenB révoqué par la chaîne → 401
• Utilisateur doit se reconnecter après détection d'un replay

Closes #10