Generates a JWT refresh token for the user (no expiry — persisted in httpOnly cookie).
User id to encode in the JWT payload.
Secret used to sign the token (typically REFRESH_KEY env var).
REFRESH_KEY
Signed JWT string.
Generates a JWT refresh token for the user (no expiry — persisted in httpOnly cookie).