fix(auth): update refresh token behavior to be reusable within TTL and add tests for token functionality

src/Auth/Controller/AuthController.php

@@ -481,11 +481,15 @@ class AuthController extends BaseController
             return $this->error(ErrorCodes::ERR_AUTH_001, ErrorCodes::message(ErrorCodes::ERR_AUTH_001), 401);
         }
 
-        // Rotate: the presented refresh token is single-use. Revoke it and issue a
-        // fresh access + refresh pair, so a stolen token can't be reused.
-        $this->tokenService->revokeRefreshToken($refreshToken);
+        // The refresh token is NOT single-use: it stays valid for its TTL and is
+        // returned unchanged. (The public site refreshes on every server render
+        // and cannot persist a rotated token from a Server Component, so rotation
+        // would log users out — see nobat724_front adapt-backend-audit-api prompt.)
+        // We keep the re-check above so a suspended user (status != 1) cannot refresh.
+        $tokens                  = $this->tokenService->issueTokens($user);
+        $tokens['refresh_token'] = $result['rawToken'];
 
-        return new JsonResponse($this->tokenService->issueTokens($user));
+        return new JsonResponse($tokens);
     }
 
     #[OA\Get(