fix: exclude RefreshToken from JSON response (G117)

backend/auth/jwt.go

@@ -23,7 +23,7 @@ var TokenAuth *jwtauth.JWTAuth
 type AuthResponse struct {
 	Token        string `json:"token"`
 	JTI          string `json:"jti"`
-	RefreshToken string `json:"refreshToken,omitempty"`
+	RefreshToken string `json:"-"`
 }
 
 // generateJTI generates a UUID v4 string using crypto/rand

backend/handlers/auth/auth_test.go

@@ -1747,9 +1747,9 @@ func TestJTI_Revocation_PostgreSQL(t *testing.T) {
 // Login Response Field Tests (new from security pass)
 // =============================================================================
 
-// TestLogin_ResponseIncludesRefreshToken verifies the login response
+// TestLogin_ResponseOmitsRefreshToken verifies the login response
-// includes a refreshToken field alongside the JWT.
+// does not include refreshToken (G117 — 90-day credential excluded from JSON).
-func TestLogin_ResponseIncludesRefreshToken(t *testing.T) {
+func TestLogin_ResponseOmitsRefreshToken(t *testing.T) {
 	ctx, tx := resetTestData(t)
 
 	handler := http.HandlerFunc(LoginHandler)
@@ -1771,6 +1771,10 @@ func TestLogin_ResponseIncludesRefreshToken(t *testing.T) {
 		t.Fatalf("expected 200, got %d. body: %s", w.Code, w.Body.String())
 	}
 
+	if strings.Contains(w.Body.String(), "refreshToken") {
+		t.Error("login response should NOT contain refreshToken (G117)")
+	}
+
 	var resp struct {
 		Token        string `json:"token"`
 		JTI          string `json:"jti"`
@@ -1786,8 +1790,8 @@ func TestLogin_ResponseIncludesRefreshToken(t *testing.T) {
 	if resp.JTI == "" {
 		t.Error("expected non-empty jti")
 	}
-	if resp.RefreshToken == "" {
+	if resp.RefreshToken != "" {
-		t.Error("expected non-empty refreshToken in login response")
+		t.Error("refreshToken should be excluded from JSON response (G117)")
 	}
 }