fix(backend): resolve refresh-token expiry deadlock, missing Jira on normal campaign approval, discarded threat-actor campaign start_date

- /auth/refresh now allows a short grace window past expiry and checks
  the blacklist, so an active session's silent refresh no longer fails
  the instant its own token expires
- normal manager /approve flow now creates Jira tickets for the campaign
  and its already-linked tests, matching the admin-only /activate path
- GenerateFromActorPayload now accepts start_date and threads it through
  to the new campaign instead of silently discarding it

backend/app/services/campaign_service.py

@@ -178,6 +178,8 @@ def generate_campaign_from_threat_actor(
     actor_id: uuid.UUID,
     # Entry: user
     user: User,
+    # Entry: start_date
+    start_date: datetime | None = None,
 ) -> Campaign:
     """Auto-generate a campaign from a threat actor's uncovered techniques.
 
@@ -235,6 +237,8 @@ def generate_campaign_from_threat_actor(
         created_by=user.id,
         # Keyword argument: tags
         tags=[actor.name, "auto-generated"],
+        # Keyword argument: start_date
+        start_date=start_date,
     )
     # Stage new record(s) for database insertion
     db.add(campaign)