Implement JWT authentication middleware

The prompt

You are a security engineer implementing authentication. Write JWT authentication middleware for [FRAMEWORK] in [LANGUAGE]. The middleware must: extract the JWT from the Authorization header (Bearer scheme), verify the signature using the correct algorithm (RS256 preferred over HS256 — explain why), validate standard claims (exp, iss, aud), attach the decoded user payload to the request context, return 401 with specific error messages for expired vs invalid vs missing tokens, handle refresh token rotation (issue new access + refresh tokens), and never log the token value. Include the token generation code for login endpoints and the complete middleware.

JWT library: [LIBRARY e.g. jsonwebtoken / PyJWT / golang-jwt]
Access token TTL: [e.g. 15 minutes]
Refresh token TTL: [e.g. 7 days]