readme

obsidian/Crussell/Crussell Nails.md

@@ -17,7 +17,7 @@
 - [x] Password hashing with bcrypt
 - [x] Middleware for auth/roles (`mw.RequireAuth`, `mw.RequireAdmin`)
 - [x] DB connection pooling
-- [ ] **Refresh token endpoint** - `RefreshTokenHandler` exists at `local.go:322`, NOT wired in router
+- [x] Refresh token endpoint - Wired to `POST /api/refresh-token`, auto-refresh in frontend
 - [x] Login rate limiting (1 attempt per 5 seconds)
 
 #### Booking System
@@ -333,7 +333,6 @@ admin_notification_reason: pending_booking | cancelled_booking | rescheduled_boo
 | **User notifications** | Notification system for regular users (booking confirmations, reminders) |
 | **Remove debug logs** | `console.log` in BookingFlow.svelte:600 and BookingCreateModal.svelte:224 |
 | **S3/R2 image hosting** | Portfolio image storage with admin upload |
-| **Refresh token endpoint** | Wire existing `RefreshTokenHandler` to router |
 | **Loyalty display component** | Show stamps in account/bookings |
 | **Email/SMS reminders** | Scheduled notification jobs |
 | **Prometheus metrics** | Monitoring integration |
@@ -556,4 +555,4 @@ if err := tx.Commit(r.Context()); err != nil { /* handle error */ }
 ### Build Tags
 - `db_dev.go` - Used with `-tags dev` for local development (localhost connection)
 - `db.go` - Production build (uses env var for host)
-- `internal/dav/service_dev.go` / `service_prod.go` - Same pattern for DAV service
+- `internal/dav/service_dev.go` / `service_prod.go` - Same pattern for DAV service