Stability checkpoint stable-v1.0.23 (svc) — Phase 4.2 wave continued: 7 more AuthController tests covering refresh + logout flows. Refresh: token rotation pinned (old deleted = single-use replay protection), 401 on invalid token, role picked from CURRENT DB state (not old token). Logout: blacklists access token + deletes refresh tokens, robust to missing Authorization header / null principal / non-Bearer scheme. Cumulative svc Phase 4.2 across v1.0.21-23: 154 new tests across 16 test files. Post-merge main pipeline #699 SUCCESS.