feat(auth): refactor authentication routes and enhance JWT handling

- Removed unused permission and app retrieval logic from the login process.
- Introduced a new endpoint for reissuing access tokens to handle role changes and account switches.
- Updated JWT payload handling to improve clarity and maintainability.
- Enhanced the readJwtPayload function for better decoding of JWT claims.

packages/shared/src/contracts/auth.ts

@@ -199,19 +199,25 @@ function isPrivateHostname(hostname: string): boolean {
   return false
 }
 
-/** Decode JWT `exp` without verifying signature. Returns null if missing/invalid. */
-export function readJwtExp(token: string): number | null {
+/** Decode JWT payload without verifying signature (claims sync only). */
+export function readJwtPayload(token: string): Record<string, unknown> | null {
   try {
     const parts = token.split('.')
     if (parts.length < 2) return null
     const json = atob(parts[1]!.replace(/-/g, '+').replace(/_/g, '/'))
-    const payload = JSON.parse(json) as { exp?: unknown }
-    return typeof payload.exp === 'number' ? payload.exp : null
+    return JSON.parse(json) as Record<string, unknown>
   } catch {
     return null
   }
 }
 
+/** Decode JWT `exp` without verifying signature. Returns null if missing/invalid. */
+export function readJwtExp(token: string): number | null {
+  const payload = readJwtPayload(token)
+  if (!payload) return null
+  return typeof payload.exp === 'number' ? payload.exp : null
+}
+
 /** True when token is missing exp or exp is in the past (30s clock-skew grace). */
 export function isJwtExpired(token: string, nowMs: number = Date.now()): boolean {
   const exp = readJwtExp(token)