Inspect the authentication flow, focusing specifically on the login and refresh-token paths.

Review only the code related to:

• User login
• Access token issuance
• Refresh token validation
• Refresh token rotation or reuse handling
• Token expiry checks
• Session invalidation related to refresh tokens

Keep changes narrowly scoped to authentication behavior. Avoid unrelated refactors, formatting churn, or broad architectural changes.

1. Identify expiry-related edge cases.
2. Fix confirmed issues with minimal code changes.
3. Add focused tests that cover the reviewed behavior.

• Access token expired but refresh token still valid
• Refresh token expired
• Refresh token missing, malformed, revoked, or reused
• Refresh token close to expiry boundary
• Clock skew or off-by-one expiry comparisons
• Login issuing tokens with incorrect expiry values
• Refresh endpoint returning stale or already-expired tokens
• Multiple refresh attempts using the same token