Agentic Prompt Templates: ReAct, File-Scope, Template M

File: src/auth/tokenService.ts
Function: refreshAccessToken()

Current behavior: The function calls the /auth/refresh endpoint and returns the new access token. It does not handle the case where the refresh token is expired — it throws an unhandled promise rejection.

Desired change: Add error handling for a 401 response from /auth/refresh. When a 401 is received, clear both tokens from localStorage, dispatch a SESSION_EXPIRED action to the Redux store, and return null.

Do not touch:
- src/auth/loginService.ts
- src/auth/tokenStorage.ts
- The existing success path logic in refreshAccessToken()
- Any other function in tokenService.ts

Done when: refreshAccessToken() handles a 401 response by clearing localStorage tokens, dispatching SESSION_EXPIRED, and returning null — without breaking the existing success path.

Starting state:
- Node.js 20.x is installed
- The repo is at /workspace/api-service
- package.json exists but there is no test suite
- The /users CRUD endpoints are implemented in src/routes/users.ts

Target state:
- A Vitest test suite exists at src/routes/users.test.ts
- Tests cover: GET /users (list), GET /users/:id (found and not found), POST /users (valid and invalid payload), DELETE /users/:id
- All tests pass with `npm test`
- No existing source files have been modified

Allowed actions:
- Create new files under src/routes/ and src/__tests__/
- Read existing source files
- Run `npm install` to add Vitest and testing utilities
- Run `npm test` to verify

Forbidden actions:
- Modify any existing source files in src/
- Create or modify any configuration files (tsconfig.json, .env, package.json scripts other than adding "test")
- Access the filesystem outside /workspace/api-service

Stop conditions — pause and report back if any of the following occur:
1. Any existing test in the repo fails after your changes
2. You cannot determine the expected behavior of an endpoint from the source code alone
3. `npm test` exits with a non-zero code after two consecutive fix attempts
4. You need to modify an existing source file to make tests pass

Checkpoints:
- After test file is created but before running tests: list the test cases you've written
- After `npm test` passes: show the final test output

Task scope: Migrate the authentication system in this codebase from session-based auth (express-session + Redis) to stateless JWT auth (short-lived access token + long-lived refresh token stored in httpOnly cookie). The scope is limited to the auth layer: src/auth/, src/middleware/authenticate.ts, and the auth-related routes in src/routes/. No other files are in scope.

Acceptance criteria:
1. All existing auth tests pass without modification to the test files
2. Login returns a JWT access token (15-min expiry) and sets a refresh token in an httpOnly cookie (7-day expiry)
3. Protected routes validate the JWT without touching Redis
4. /auth/refresh issues a new access token when the refresh token is valid
5. Logout clears the cookie and invalidates the refresh token server-side (use an in-memory denylist for this task)
6. No session-related code or Redis imports remain in the src/auth/ or src/middleware/ directories

Stop conditions — halt immediately and report if:
- Any file outside src/auth/, src/middleware/authenticate.ts, or src/routes/auth.ts requires modification
- Acceptance criterion 1 cannot be satisfied without changing test files
- You encounter a dependency that conflicts with the JWT library implementation
- You are unsure whether a change will break a non-auth subsystem

Forbidden expansions — do not, under any circumstances:
- Refactor non-auth middleware
- Update dependencies beyond what JWT auth requires
- Add logging, monitoring, or error tracking
- Modify the database schema or ORM models
- Improve or optimize code you encounter that is outside the defined scope

Session strategy:
- This task fits in a single session. Do not split across sessions unless you hit a stop condition.
- Run /compact if your context reaches 50% before the task is complete.
- If you use /compact, your next message must be a summary of: completed steps, current state, and next action.
- Start each work block with a one-line status: "Step N of 6 acceptance criteria met."

Reporting format:
- Before starting: list the files you will touch and confirm they are within scope.
- After each acceptance criterion is met: state which criterion and what you did.
- On completion: show the full output of the test suite and a checklist of all 6 acceptance criteria marked complete.