[BE Feat] Add a system to invalidate authentication JWT

[juancwu]

Right now all generated tokens are valid as long as it is not expired. This means that for any token that was generated for a user will still be valid even if the user changed their password (given its not expired). This is not secure in a way if someone loses their account or somehow want to logout from all devices, it won't be able to be done through the backend only.

We need a system to invalidate access/refresh tokens and this process need to take place when the user changes password too.