Auth & token services

token.service.ts

Baby: Makes and checks JWT access tokens; manages refresh token lifecycle.

• signAccessToken(userId) — short-lived JWT
• verifyAccessToken(token) — returns { userId } or throws
• createRefreshToken / rotateRefreshToken / revokeRefreshToken — DB-backed sessions

Implements ITokenService from types.

google.service.ts

Baby: Talks to Google to prove the login is real.

• verifyIdToken — mobile/extension
• exchangeCode — web OAuth code flow

Implements IGoogleService.