feat(gateway): add /refresh_token API with grace window + refresh limit

- POST /refresh_token: accept current Bearer token (or Cookie fallback),
  verify RSA signature, check grace window (iat + keep_time * multiplier)
  and refresh count limit, then issue a new token.
- Token payload extended with iat, refresh_count, max_refresh fields.
- iat preserves original issue time; created_at updates on each refresh.
- Rate limited: 5 req / 5 min / IP via RateLimiter.
- Config: Token.refresh_grace_multiplier (default 2), Token.max_refresh (default 10).
- Backward compatible: old tokens without new fields still pass proxy checks.

gateway/example.ini

@@ -14,6 +14,10 @@ opened  = http://127.0.0.1:9200;http://127.0.0.1:8006;
 [Token]
 # Token 有效期（秒），默认 3600 = 1 小时
 keep_time = 3600
+# Token 刷新宽限期倍数：过期后 iat + keep_time * 倍数 窗口内仍可刷新，默认 2
+refresh_grace_multiplier = 2
+# Token 生命周期内最大刷新次数，超过后需重新登录，默认 10
+max_refresh = 10
 
 [Admin]
 # 管理员账号白名单（分号分隔）。登录时命中即在 Token payload 写入 is_admin=true，