Address code review: remove JWT secret exports and clarify incomplete refresh implementation

Co-authored-by: alexpolo1 <14327609+alexpolo1@users.noreply.github.com>

backend/src/middleware/auth.js

@@ -110,7 +110,5 @@ module.exports = {
   verifyToken,
   generateAccessToken,
   generateRefreshToken,
-  verifyRefreshToken,
-  JWT_ACCESS_SECRET,
-  JWT_REFRESH_SECRET
+  verifyRefreshToken
 };

frontend/src/contexts/AuthContext.js

@@ -51,6 +51,9 @@ export const AuthProvider = ({ children }) => {
           try {
             // Call refresh endpoint WITHOUT sending refreshToken in body
             // Server should read refresh token from HttpOnly cookie
+            // NOTE: This implementation is incomplete - backend does not yet support
+            // HttpOnly cookie-based refresh. This will fail until backend is updated.
+            // See TODO items in PR description for follow-up work required.
             const response = await axios.post(`${API_BASE_URL}/api/auth/refresh`, {}, {
               withCredentials: true // Important: send cookies with request
             });