Fix/issue 2088 jwt token replay

[Vachhani-Tapan]

Fix: JWT Token Replay Vulnerability

Resolves#2088

Description

This PR addresses a high-risk security vulnerability where JWT tokens remained valid on the server even after explicit user logout, allowing potential session hijacking and token replay attacks.

Code Changes

• backend/src/controllers/user.controller.js: During logout, the access token is now intercepted and explicitly written to a stateful Redis blacklist (setex blacklist:<token> <TTL> true). The TTL matches the token's remaining time to naturally expire, preventing unbounded memory growth in Redis.
• backend/src/middlewares/auth.middleware.js: Added a verification step immediately following token signature validation. The middleware now queries Redis; if the JWT token is present in the blacklist, the request is immediately rejected with a 401 Unauthorized.

Verification

• Verified token is actively pushed to Redis upon logout.
• Confirmed subsequent requests with the blacklisted token are blocked with HTTP 401.

[vercel]

@Vachhani-Tapan is attempting to deploy a commit to the Dev's projects Team on Vercel.

A member of the Team first needs to authorize it.