Authentication System with JWT and Refresh Tokens

Build a complete authentication system with JWT access tokens and refresh tokens: - Backend framework: [e.g., 'Express.js', 'FastAPI', 'Laravel'] - Database: [e.g., 'PostgreSQL', 'MongoDB'] - Frontend: [e.g., 'React', 'Vue', 'Mobile app'] The system should include: 1. **User Registration** — Email/password signup with validation, password hashing (bcrypt) 2. **Login** — Returns JWT access token (15 min expiry) + refresh token (7 day expiry) 3. **Token Refresh** — Endpoint to get new access token using refresh token 4. **Logout** — Invalidate refresh token (token blacklist or DB deletion) 5. **Password Reset** — Secure reset flow with email verification link 6. **Protected Routes** — Middleware to verify JWT and extract user data 7. **Role-Based Access** — Admin/User/Editor roles with permission checking 8. **Rate Limiting** — Prevent brute force on login (max 5 attempts per 15 min) 9. **Security Headers** — CORS, helmet, cookie settings for refresh token 10. **Token Storage** — Best practices for storing tokens (httpOnly cookies vs localStorage) Provide complete, production-ready code with proper error handling, not just snippets. Include the database schema for users and refresh_tokens tables.