Four Ways a Refresh Token Request Fails — Only One Means Trouble

Invalid, expired, revoked, and reused tokens aren't the same. Build real refresh token reuse detection in NestJS + Postgres—and verify it revokes only the compromised session.