fix: update cookie handling and token expiration settings for improve…

[Ketbome]

Description

Fixes the cookie-based authentication flow for local development (http://localhost) and updates JWT expiration configuration.

Main changes:

• Adjusts ALLOW_INSECURE_AUTH_COOKIES to allow local testing without HTTPS when needed.
• Adds/configures JWT_EXPIRES_IN to explicitly control access_token lifetime.
• Verifies that refresh token flow still works with rotation and revocation in /auth/refresh.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📝 Documentation update
• 🔧 Configuration change
• ♻️ Refactoring (no functional changes)
• 🧪 Tests