feat: implement Redis-first refresh token storage with Supabase fallback

feat: implement stateless JWT-based authentication with refresh tokens stored in HTTPOnly Cookies

feat: implement in-memory email rate limiting and adjust RAG search parameters

feat: move auth constants to dedicated module and add unit tests for avatar upload functionality