slowapi==0.1.9

Rebuild the API image after pulling: docker compose ... up -d --build api

1. POST /token → { access_token, refresh_token, expires_in }
2. Call APIs with Authorization: Bearer <access_token>
3. When access expires → POST /token/refresh with { "refresh_token": "..." }
4. Use new pair; old refresh token should be discarded client-side

Refresh tokens include typ: refresh and are rejected on protected routes.

If /docs is blank but /openapi.json returns 200, the API is fine — the browser blocked Swagger UI scripts due to Content-Security-Policy: default-src 'none'. Documentation paths now use a relaxed CSP (see app/middleware/security_headers.py).

1. Register with strong password: Admin123!
2. Login via /token — copy access_token and refresh_token
3. Authorize with access token
4. Call /audit-logs, /devices, etc.
5. /token/refresh with JSON body { "refresh_token": "..." }
6. Use expired/wrong token → 401 + INVALID_TOKEN in audit logs
7. Hit /token 6+ times with wrong password → 429 lockout + LOGIN_LOCKOUT audit

for i in {1..10}; do curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost/token -d "username=x&password=y"; done

Expect 429 after the configured login limit.