feat(api,core,infra): refactor endpoint routing and add institution account discovery

- Move login and refresh endpoints under a unified /auth route group
- Relocate institution connection logic from /accounts to /institutions
- Implement GET /institutions/{id}/available to fetch real-time Plaid
accounts
- Introduce HttpRequestBuilder utility to streamline integration testing
- Enhance PlaidService with GetAccountsAsync to support account fetching
- Clean up global usings and project structure for better domain
isolation

src/FiscalOS.API/Auth/Refresh/Endpoint.cs

@@ -0,0 +1,60 @@
+namespace FiscalOS.API.Auth.Refresh;
+
+internal static class Endpoint
+{
+  private const string Route = "/refresh";
+
+  public static RouteHandlerBuilder MapRefreshEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapPost(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromServices] AppDbContext appDbContext,
+    [FromServices] TimeProvider timeProvider,
+    [FromServices] ITokenGenerator tokenGenerator
+  )
+  {
+    var requestUserId = httpContext.GetUserId();
+    var token = httpContext.GetRefreshTokenFromCookie();
+
+    var refreshToken = await appDbContext.RefreshTokens
+      .Include(t => t.User)
+      .SingleOrDefaultAsync(t => t.Token == token);
+
+    if (refreshToken is null || refreshToken.User is null)
+    {
+      return Results.BadRequest();
+    }
+
+    if (refreshToken.UserId != requestUserId)
+    {
+      await appDbContext.RefreshTokens
+        .Where(t => t.UserId == refreshToken.UserId)
+        .ExecuteUpdateAsync(t => t.SetProperty(t => t.Revoked, true));
+
+      await appDbContext.SaveChangesAsync();
+
+      return Results.Forbid();
+    }
+
+    var now = timeProvider.GetUtcNow();
+
+    if (refreshToken.Revoked || refreshToken.IsExpired(now))
+    {
+      return Results.BadRequest();
+    }
+
+    var accessToken = tokenGenerator.GenerateAccessToken(refreshToken.User);
+    var newRefreshToken = tokenGenerator.GenerateRefreshToken(refreshToken.User);
+
+    refreshToken.Revoke();
+    await appDbContext.RefreshTokens.AddAsync(newRefreshToken);
+    await appDbContext.SaveChangesAsync();
+
+    httpContext.SetRefreshTokenCookie(newRefreshToken);
+
+    return Results.Ok(Response.From(accessToken));
+  }
+}