Issue a new access + refresh token pair for the given principal.
Refresh a token pair: verify the refresh token, revoke its jti, and issue a new pair (rotation). Returns null if the token is invalid, expired, tampered with, not a refresh token, or already revoked (replay).
Revoke a refresh token (logout). Returns true if a live record was found and revoked; false when the token does not verify or no live record exists (missing, expired, or already revoked).
Refresh token service implementing token rotation and revocation.
This is NOT an IAuthStrategy and NOT an IAuthService method — it is an app-instantiated service reached directly by the app's login/refresh/logout route handlers.