Issue 4 jwt (#24)

migrations/002_refresh_tokens.sql

@@ -0,0 +1,20 @@
+-- ==========================================
+-- Chat Switchboard - Refresh Tokens
+-- ==========================================
+-- Supports JWT refresh token rotation.
+-- Old tokens are revoked on each refresh.
+
+CREATE TABLE refresh_tokens (
+    id          UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    user_id     UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    token_hash  TEXT NOT NULL UNIQUE,
+    expires_at  TIMESTAMP WITH TIME ZONE NOT NULL,
+    created_at  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    revoked_at  TIMESTAMP WITH TIME ZONE
+);
+
+CREATE INDEX idx_refresh_tokens_user ON refresh_tokens(user_id);
+CREATE INDEX idx_refresh_tokens_hash ON refresh_tokens(token_hash) WHERE revoked_at IS NULL;
+
+-- Cleanup: auto-delete expired tokens older than 30 days
+-- (run periodically or via pg_cron if available)