luizcurti/authkit-clean-arch ? reverse-engineered prompt

Build me a production ready authentication API in TypeScript with clean separation between the app logic and the infrastructure.

I want users to sign in with a Facebook token, then get a short lived access token and a refresh token that can be rotated safely, with logout and replay protection. After login, authenticated users should be able to upload, replace, and delete a profile picture, with the image stored privately and only valid PNG or JPG files accepted. Please include proper validation for environment variables, clear JSON error responses with a request id, health checks, and a protected metrics or admin status endpoint.

Use PostgreSQL for persistence, S3 style storage for profile images, and make it work nicely in Docker for local development. Also add tests from the start, including route tests and integration tests, and set it up so the app refuses to start if required secrets or config are missing. If you need current library details, look them up online before wiring things up.