Implement Authentication and Authorisation

Implement an authentication and authorisation system for the following:

Application type: [e.g. REST API / Next.js app / mobile backend / internal tool]
Auth method: [JWT / session cookies / OAuth / magic link / passkeys — specify]
User roles needed: [list roles and what each can do — e.g. admin / editor / viewer]
Framework: [e.g. Express / FastAPI / Next.js / Django]
Database: [e.g. PostgreSQL / MongoDB]

Implement:
1. Registration: input validation, password hashing (bcrypt/argon2), duplicate email handling
2. Login: credential verification, token/session generation, response format
3. Token refresh: access token + refresh token pattern (if JWT)
4. Logout: token invalidation / session destruction
5. Auth middleware: how to protect routes — verify token, attach user to request
6. Role-based access control: middleware to check permissions per route
7. Password reset flow: request → email token → reset

Security requirements to implement:
- Rate limiting on auth endpoints
- Brute force protection
- Secure cookie settings (if applicable)
- What to log (and what never to log)