Implement authentication with JWTs

Implement a complete JWT authentication flow in [Language/Framework]. Cover token generation on successful login, signature verification on every protected route, refresh token rotation with a secure rotation strategy, client-side secure storage recommendations, and expiry and revocation handling. Flag the most common JWT implementation mistakes to avoid, such as using the alg:none vulnerability or weak signing secrets.