How to properly organize work with JWT tokens on the backend? Where and how should Access and Refresh tokens be checked, how to ensure their secure storage, and what to do if a user's token needs to be revoked due to compromise before its expiration?