update auth for refresh tokens and token invalidation

docs/vigilcare-records-prd.md

@@ -464,10 +464,13 @@ Reject is allowed from `pending_verification` (verifier; separation of duties ap
 **Description:** JWT auth with role claims. Every state transition writes a `DigitizationEvent`. Document access logged.
 
 **Endpoints:**
-- `POST /api/v1/auth/login`
+- `POST /api/v1/auth/login` — returns access token (15 min), refresh token (7 days), and user profile
+- `POST /api/v1/auth/refresh` — rotates refresh token and issues new access token
+- `POST /api/v1/auth/logout` — revokes refresh token server-side
 - `GET /api/v1/auth/me`
 
 **Audit requirements:**
+- Auth events (`USER_LOGOUT`, `TOKEN_REFRESHED`) persisted in `auth_audit_events`
 - Who viewed a scan and when
 - Who changed which draft field (field-level diff in event metadata on save)
 - Who approved promotion and which live record IDs were created