RefreshTokenService.prototype.refresh(refreshToken: string): Promise<TokenPair | null>
Refresh a token pair: verify the refresh token, revoke its jti, and issue a new pair (rotation). Returns null if the token is invalid, expired, tampered with, not a refresh token, or already revoked (replay).
Promise<TokenPair | null>