JWT, refresh token, HttpOnly cookie, social login Google/Facebook/Discord, role-based access, dan anti brute force siap di backend.