feat(auth): include subscription tier in token and session payload

- Adds subscription tier info to access/refresh tokens.
- Stores tier details in session Redis record.
- Returns tier data in login/register response.
- Uses default tier when user has none.

lib/auth/jwt.ts

@@ -9,6 +9,8 @@ interface TokenPayload {
   userId: number;
   username: string;
   type: "access" | "refresh";
+  tierSlug?: string;
+  tierLevel?: number;
 }
 
 /**
@@ -45,14 +47,22 @@ const REFRESH_TOKEN_EXPIRY = "7d"; // 7 dias
  * @param username - Nome de usuário
  * @returns Access token
  */
+interface TokenOptions {
+  tierSlug?: string | null;
+  tierLevel?: number | null;
+}
+
 export function generateAccessToken(
   userId: number,
-  username: string
+  username: string,
+  options?: TokenOptions
 ): string {
   const payload: TokenPayload = {
     userId,
     username,
     type: "access",
+    tierSlug: options?.tierSlug ?? undefined,
+    tierLevel: options?.tierLevel ?? undefined,
   };
 
   return jwt.sign(payload, getJWTSecret(), {
@@ -68,12 +78,15 @@ export function generateAccessToken(
  */
 export function generateRefreshToken(
   userId: number,
-  username: string
+  username: string,
+  options?: TokenOptions
 ): string {
   const payload: TokenPayload = {
     userId,
     username,
     type: "refresh",
+    tierSlug: options?.tierSlug ?? undefined,
+    tierLevel: options?.tierLevel ?? undefined,
   };
 
   return jwt.sign(payload, getJWTRefreshSecret(), {
@@ -89,6 +102,8 @@ export function generateRefreshToken(
 export function verifyAccessToken(token: string): {
   userId: number;
   username: string;
+  tierSlug?: string;
+  tierLevel?: number;
 } | null {
   try {
     const decoded = jwt.verify(token, getJWTSecret()) as TokenPayload;
@@ -100,6 +115,8 @@ export function verifyAccessToken(token: string): {
     return {
       userId: decoded.userId,
       username: decoded.username,
+      tierSlug: decoded.tierSlug,
+      tierLevel: decoded.tierLevel,
     };
   } catch (error) {
     return null;
@@ -114,6 +131,8 @@ export function verifyAccessToken(token: string): {
 export function verifyRefreshToken(token: string): {
   userId: number;
   username: string;
+  tierSlug?: string;
+  tierLevel?: number;
 } | null {
   try {
     const decoded = jwt.verify(token, getJWTRefreshSecret()) as TokenPayload;
@@ -125,6 +144,8 @@ export function verifyRefreshToken(token: string): {
     return {
       userId: decoded.userId,
       username: decoded.username,
+      tierSlug: decoded.tierSlug,
+      tierLevel: decoded.tierLevel,
     };
   } catch (error) {
     return null;