feat: token refresh with age-based logic

- RefreshTokens checks token age and chooses the right path:
  - refresh_token > 90 days: re-auth via WikimediaLogin (full login)
  - access_token > 24 hours: refresh via WikimediaTokenRefresh
  - otherwise: return current tokens
- WikimediaTokenRefresh posts to /v1/token-refresh endpoint
- Login also uses WikimediaLogin instead of local RotateTokens
- Removed dead RotateTokens, RefreshByToken, and randomHex
- DSN includes parseTime=true for timestamp columns

1 files changed, 1 insertions, 1 deletions

diff --git a/main.go b/main.go
index 813ac41..6662d90 100644
--- a/main.go
+++ b/main.go
@@ -59,7 +59,7 @@ func loadConfig() (*Config, error) {
 }
 
 func buildDSN(cfg *Config) string {
-	return fmt.Sprintf("%s:%s@tcp(%s)/%s",
+	return fmt.Sprintf("%s:%s@tcp(%s)/%s?parseTime=true",
 		cfg.Database.Username,
 		cfg.Database.Password,
 		cfg.Database.Host,