WIP checkpoint: Address review feedback: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions

backend/app/routers/auth.py

@@ -1,7 +1,7 @@
 """Authentication router - login, register, token refresh."""
 
 import uuid
-from datetime import datetime, timedelta, timezone
+from datetime import date, datetime, timedelta, timezone
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
@@ -76,8 +76,13 @@ def _create_access_token(data: dict) -> str:
 
 
 def _create_refresh_token(data: dict) -> str:
-    """Create a signed refresh token using RS256."""
+    """Create a signed refresh token using RS256.
+
+    Includes a unique ``jti`` claim so that concurrent calls produce
+    distinct tokens even when issued within the same second.
+    """
     to_encode = data.copy()
+    to_encode["jti"] = str(uuid.uuid4())
     expire = datetime.now(timezone.utc) + timedelta(
         days=settings.REFRESH_TOKEN_EXPIRE_DAYS
     )
@@ -99,7 +104,7 @@ def hash_password(password: str) -> str:
     return pwd_context.hash(password)
 
 
-def calculate_age(birth_date, today=None) -> int:
+def calculate_age(birth_date: date, today: date | None = None) -> int:
     """Calculate age in years from a birth date.
 
     Args:
@@ -174,7 +179,7 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
         date_of_birth=dob,
     )
     db.add(user)
-    await db.commit()
+    await db.flush()  # flush to get user.id before creating refresh token
     await db.refresh(user)
 
     # Create access token