feat(auth-backend): validate catalog user existence on refresh token usage

Add `experimentalRefreshToken.validateCatalogUserExistence` config option
that checks whether the user's catalog entity still exists before issuing
a new access token during refresh. If the user has been removed from the
catalog (e.g. offboarded), the refresh is rejected and the session is
revoked. Transient catalog errors reject the refresh but preserve the
session for retry.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>

plugins/auth-backend/config.d.ts

@@ -133,6 +133,14 @@ export interface Config {
        * @visibility backend
        */
       maxTokensPerUser?: number;
+      /**
+       * Whether to validate that the user's catalog entity exists when
+       * refreshing a token. When enabled, tokens for users removed from
+       * the catalog will be rejected and revoked.
+       * @default false
+       * @visibility backend
+       */
+      validateCatalogUserExistence?: boolean;
     };
 
     /**