fix(api): bind refresh tokens to issuing client_id

[markwylde]

Summary

Bind refresh tokens to the issuing client so a token minted for one client cannot be refreshed by another.

Changes

• persist issuing clientId in user session data when minting refresh tokens from /token authorization_code flow
• enforce refresh-token client binding in /token refresh_token flow
• reject refresh attempts when binding is missing or client does not match
• add API tests for client binding extraction and mismatch rejection
• update specs and whitepaper docs to document client-bound refresh behavior

Validation

• npm run -w packages/api test -- src/controllers/token.test.ts --test-reporter=dot
• npm run tidy
• npm run build

Closes #80