Windsurf Prompt Enhancer

Refactor the authentication system from session-based to JWT tokens. **Current state:** - Express.js backend with session-based auth - Sessions stored in Redis - Auth middleware in /middleware/auth.js **Target state:** 1. Replace sessions with JWT access + refresh tokens 2. Access token: 15min expiry, stored in memory 3. Refresh token: 7 days, stored in httpOnly cookie 4. Add token refresh endpoint at POST /api/auth/refresh 5. Update auth middleware to verify JWTs **Requirements:** - Maintain backward compatibility during migration - Add proper error handling for token expiration - Update all protected routes to use new middleware - Add tests for the new auth flow **Please update:** middleware, auth routes, and any files importing the auth middleware.