Implement JWT auth: POST /register (hash password with bcrypt), POST /login (return access+refresh tokens), GET /me (protected, verify JWT middleware), POST /refresh. Store refresh tokens in httpOnly cookie. Access token expires in 15min, refresh in 7 days.
