refactor: Phase 5 - JWT token lifecycle (Access + Refresh + Auto-refresh)

**Implementation:**
- AuthService: Split token generation
  * AccessToken: 15 minutes
  * RefreshToken: 7 days (10080 minutes)
  * New: GenerateTokenPair() method
  * New: RefreshAccessTokenAsync() method

- AuthTokenPair: New record (accessToken, refreshToken, expiresIn)

- AuthController: New /api/auth/refresh endpoint
  * POST /api/auth/refresh?refreshToken=...
  * Response: { accessToken, refreshToken, expiresIn }
  * RefreshTokenRequest DTO

- TokenRefreshHandler: New DelegatingHandler
  * Automatic Bearer token injection
  * 401 response handling
  * Auto-refresh with retry
  * localStorage sync (accessToken, refreshToken, tokenExpiry)

- CustomAuthenticationStateProvider: Token storage split
  * Before: auth_token (single)
  * After: accessToken, refreshToken, tokenExpiry
  * LoginAsync signature updated

- Login.razor: Handle token pair
  * LoginResponse: { accessToken, refreshToken, expiresIn }
  * Call new LoginAsync(accessToken, refreshToken, expiresIn)

- Program.cs: TokenRefreshHandler registration
  * AddScoped<TokenRefreshHandler>()
  * AdminDashboardClient pipeline: .AddHttpMessageHandler<TokenRefreshHandler>()

**SOLID Principles:**
✓ S (Single Responsibility): TokenRefreshHandler handles only token refresh
✓ D (Dependency Inversion): DelegatingHandler abstracts HTTP concerns
✓ O (Open/Closed): Token lifetime extension without code changes

**Security Pattern:**
- Short-lived access tokens (15min) reduce theft window
- Refresh tokens (7d) enable persistence without storing secrets
- Automatic refresh is transparent to components

**Flow:**
Blazor → AdminDashboardClient → TokenRefreshHandler (auto-add Bearer)
  → 401 → RefreshTokenAsync() → POST /api/auth/refresh
  → Store new pair → Retry original request

Status: Token lifecycle complete, ready for SignalR integration (Phase 6)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TaxBaik.Web/Services/AuthService.cs

@@ -14,7 +14,8 @@ public class AuthService
     private readonly ILogger<AuthService> _logger;
     private readonly string _jwtSecretKey;
     private readonly string? _passwordResetToken;
-    private readonly int _tokenExpirationMinutes = 480; // 8시간
+    private readonly int _accessTokenExpirationMinutes = 15;   // Access Token: 15분
+    private readonly int _refreshTokenExpirationMinutes = 10080; // Refresh Token: 7일
 
     public AuthService(IAdminUserRepository adminUserRepository, ILogger<AuthService> logger, IConfiguration configuration)
     {
@@ -24,12 +25,10 @@ public class AuthService
         _passwordResetToken = configuration["Admin:PasswordResetToken"];
     }
 
-    public async Task<string?> AuthenticateAndGenerateTokenAsync(string username, string password)
+    public async Task<AuthTokenPair?> AuthenticateAndGenerateTokenPairAsync(string username, string password)
     {
         if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))
-        {
             return null;
-        }
 
         var user = await _adminUserRepository.GetByUsernameAsync(username);
         if (user == null)
@@ -52,7 +51,35 @@ public class AuthService
 
         _logger.LogInformation("로그인 성공: {Username}", username);
         await _adminUserRepository.UpdateLastLoginAtAsync(user.Id);
-        return GenerateJwtToken(user);
+        return GenerateTokenPair(user);
+    }
+
+    public async Task<AuthTokenPair?> RefreshAccessTokenAsync(string refreshToken)
+    {
+        try
+        {
+            var principal = ValidateRefreshToken(refreshToken);
+            if (principal == null)
+            {
+                _logger.LogWarning("Refresh token 검증 실패");
+                return null;
+            }
+
+            var username = principal.FindFirstValue(ClaimTypes.Name);
+            if (string.IsNullOrWhiteSpace(username))
+                return null;
+
+            var user = await _adminUserRepository.GetByUsernameAsync(username);
+            if (user == null)
+                return null;
+
+            return GenerateTokenPair(user);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Refresh token 처리 중 오류");
+            return null;
+        }
     }
 
     public async Task<bool> ChangePasswordAsync(string username, string currentPassword, string newPassword)
@@ -92,7 +119,7 @@ public class AuthService
         return true;
     }
 
-    private string GenerateJwtToken(AdminUser user)
+    private AuthTokenPair GenerateTokenPair(AdminUser user)
     {
         var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtSecretKey));
         var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
@@ -104,14 +131,51 @@ public class AuthService
             new Claim("username", user.Username)
         };
 
-        var token = new JwtSecurityToken(
+        var accessToken = new JwtSecurityToken(
             issuer: "taxbaik-admin",
             audience: "taxbaik-admin-client",
             claims: claims,
-            expires: DateTime.UtcNow.AddMinutes(_tokenExpirationMinutes),
+            expires: DateTime.UtcNow.AddMinutes(_accessTokenExpirationMinutes),
             signingCredentials: creds);
 
-        return new JwtSecurityTokenHandler().WriteToken(token);
+        var refreshToken = new JwtSecurityToken(
+            issuer: "taxbaik-admin",
+            audience: "taxbaik-admin-client",
+            claims: claims,
+            expires: DateTime.UtcNow.AddMinutes(_refreshTokenExpirationMinutes),
+            signingCredentials: creds);
+
+        return new AuthTokenPair(
+            new JwtSecurityTokenHandler().WriteToken(accessToken),
+            new JwtSecurityTokenHandler().WriteToken(refreshToken),
+            _accessTokenExpirationMinutes * 60
+        );
+    }
+
+    public ClaimsPrincipal? ValidateRefreshToken(string token)
+    {
+        try
+        {
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwtSecretKey));
+            var handler = new JwtSecurityTokenHandler();
+            var principal = handler.ValidateToken(token, new TokenValidationParameters
+            {
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKey = key,
+                ValidateIssuer = true,
+                ValidIssuer = "taxbaik-admin",
+                ValidateAudience = true,
+                ValidAudience = "taxbaik-admin-client",
+                ValidateLifetime = true,
+                ClockSkew = TimeSpan.Zero
+            }, out SecurityToken validatedToken);
+
+            return principal;
+        }
+        catch
+        {
+            return null;
+        }
     }
 
     public ClaimsPrincipal? ValidateToken(string token)
@@ -150,3 +214,10 @@ public class AuthService
             && System.Security.Cryptography.CryptographicOperations.FixedTimeEquals(valueBytes, expectedBytes);
     }
 }
+
+public class AuthTokenPair(string accessToken, string refreshToken, int expiresIn)
+{
+    public string AccessToken { get; } = accessToken;
+    public string RefreshToken { get; } = refreshToken;
+    public int ExpiresIn { get; } = expiresIn;
+}