Add Docker Registry AIO with Nuxt Token Auth and admin UI.

Compose brings up registry:3 plus a Prisma/SQLite Nuxt app for docker login, ACL management, and image browsing with shadcn-vue.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/server/utils/refresh.ts

@@ -0,0 +1,26 @@
+import { SignJWT, jwtVerify } from 'jose'
+import { randomUUID } from 'node:crypto'
+
+function refreshSecret(): Uint8Array {
+  const secret = process.env.SESSION_SECRET || 'dev-session-secret-change-me'
+  return new TextEncoder().encode(`refresh:${secret}`)
+}
+
+export async function createRefreshToken(username: string): Promise<string> {
+  return new SignJWT({ typ: 'refresh', username })
+    .setProtectedHeader({ alg: 'HS256' })
+    .setJti(randomUUID())
+    .setIssuedAt()
+    .setExpirationTime('30d')
+    .sign(refreshSecret())
+}
+
+export async function verifyRefreshToken(token: string): Promise<string | null> {
+  try {
+    const { payload } = await jwtVerify(token, refreshSecret())
+    if (payload.typ !== 'refresh' || typeof payload.username !== 'string') return null
+    return payload.username
+  } catch {
+    return null
+  }
+}