fix(P1-security): Reduce access token to 15min, add refresh session table, implement token revocation on logout

feat: Complete project scaffold - backend (FastAPI) + frontend (Next.js 15) + scraper + LLM gateway