Refresh
auth
Refresh
Exchange a still-valid JWT for a fresh one with a full TTL window.
Requires a (non-expired) bearer token or oneinbox_token cookie. Once the
token has expired the client must log in again — this is deliberate (no
long-lived refresh token to steal). Mints a new access token and re-sets
the cookie, mirroring /login.
POST
Refresh