saicrasticgaurav/login-system ? reverse-engineered prompt

Build me a secure login and signup system for a web app using Node, Express, MongoDB, and JWT.

I want users to be able to register, log in, verify their account with an OTP, and then stay signed in with access tokens and refresh tokens. Please include refresh token rotation, protected routes, logout, logout from one device only, and logout from all devices. It should also handle multiple active sessions on different devices, and automatically renew access tokens when they expire.

Make it feel like a real production ready auth flow, with clear separation for users, tokens, sessions, and verification. Use MongoDB for storing user and session data, and wire up email sending for the OTP if needed. If anything is missing, look up current docs online and build it in a clean, working way.