fix: add missing access token JTI claim and blacklist check (#878)

[fahatadam]

Title

fix: add missing access token JTI claim and blacklist check

Description

What was done:

• Updated the auth.service.ts to include a unique jti (using randomUUID from the native crypto module) in the payload of every generated access token.
• Updated the JwtPayload interface to strongly type the new jti property.
• Injected TokenBlacklistService into the JwtStrategy.
• Added a step to the JwtStrategy.validate() method to check the extracted jti against the token blacklist on every incoming request, throwing an UnauthorizedException if the token was found to be revoked.
• Included unit tests in jwt.strategy.spec.ts mocking the blacklist validation flow to confirm requests with revoked jtis are properly rejected.

Why it was done:
Previously, access tokens only contained {sub, email, role}, preventing the targeted revocation of individual tokens. Without a jti (JWT ID), blacklisting required revoking all tokens for a given user. Introducing the jti enables a coarse-grained revocation strategy and solves targeted logout capabilities (e.g. logging out a specific device) to prevent replay attacks after a blacklist bypass.

How it was verified:

• Verified jti inclusion alongside the normal payload upon token generation.
• Mocked the TokenBlacklistService in unit testing to simulate a revoked JWT ID check, successfully confirming that an UnauthorizedException is thrown when a matching blacklisted jti makes an authenticated request.

Closes #878

[drips-wave]

@fahatadam Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project.