Refresh token for the web client. The web client authenticates via the HttpOnly WebAPI.Infrastructure.AuthCookie and never has direct access to the JWT value, so the token is read from the cookie instead of a request parameter, and the renewed token is returned only via the refreshed cookie — not in the response body. Mobile/partner clients keep using M:BankingAPI.Controllers.AuthController.RefreshToken(System.String).