Refresh token length should be configurable (currently hardcoded to 12)

Current behavior

Refresh tokens are hardcoded to 12 alphanumeric characters in [internal/models/refresh_token.go](



Problem

12 characters is a short token for a credential that can live for days or weeks. While token rotation mitigates some risk, a stolen token within its reuse interval is still exploitable — and a longer token raises the bar meaningfully.

This also causes friction with client-side validation in some SDKs and native apps that expect tokens of a more typical length (e.g. 32+ chars).

Suggested fix

Either:
• Increase the hardcoded length to 32 (one-line change, no breaking changes), or
• Expose it as a configurable env var (e.g. GOTRUE_REFRESH_TOKEN_LENGTH)

References
• Community discussion: