ADMIN

Issues a new session from a refresh token, without re-entering a password
or authenticator code.

Takes no request body: the refresh token is read from the
admin_refresh_token cookie set at sign-in, so send the request with
credentials included. Refresh tokens rotate, and a replacement arrives as
a new cookie on the response — nothing for the caller to store.

Role changes take effect here — a refreshed token carries the
administrator's current permissions.