"Remember me" on login

Currently POST /auth/login silently ignores any remember_me field in the request body -- every session gets a refresh token good for REFRESH_TOKEN_TTL_DAYS (30 days by default), no matter what the client asks for. REMEMBER_ME_REFRESH_TOKEN_TTL_DAYS (180 days by default) already exists in config but nothing reads it, so there is no way for a client to ask for a longer-lived session on a trusted device.

login() never reads remember_me from the request body, so every login gets the plain REFRESH_TOKEN_TTL_DAYS regardless of what the client asks for.

1. POST /auth/login with {"email":..., "password":..., "remember_me": true} for an account with no 2FA.
2. Inspect the returned refresh token's expiry.
3. Observe: expires_at - issued_at is ~30 days (REFRESH_TOKEN_TTL_DAYS), not ~90/180 (REMEMBER_ME_REFRESH_TOKEN_TTL_DAYS).

This is a small end-to-end plumbing exercise: a value has to travel from the request body, through the route handler, through issue_token_pair(), into issue_refresh_token(), and finally into the expires_at written to the database -- with no existing parameter to carry it. It is a good exercise in extending an existing call chain without breaking any of its other callers (rotate_refresh_token() and the 2FA-verify login path both call into the same functions and must keep working exactly as before).

Look at every call site of issue_token_pair() and issue_refresh_token() in tokens.py and routes.py. Decide how a "use this TTL instead of the config default" override should be threaded through without forcing every other caller to specify it -- login() is the only caller that should ever pass a non-default TTL.