feature request: Clarify SPA refresh token TTL behavior on rotation (revisit #4520)

### What problem did you meet? We just got bitten by an unexpected forced sign-out 14 days after a user's initial sign-in on our SPA, even though tokens had been rotating fine the whole time. After digging into [`defaults.ts`](https://github.com/logto-io/logto/blob/master/packages/core/src/oidc/defaults.ts), it turns out that for SPAs the rotated RT just inherits the old token's `remainingTTL` no matter how often you rotate. The code comment is pretty direct about this: _"Non-Sender Constrained SPA RefreshTokens do not have infinite expiration through rotation"_. Totally reasonable as a security stance — but the docs threw us off a bit. [This section](https://docs.logto.io/integrate-logto/application-data-structure#refresh-token-time-to-live-ttl-in-days) says: > TTL refreshment is unavailable in SPA... **To enhance the user experience, you can enable the "Rotate refresh token" feature...** We read that as "rotation extends TTL and lets users stay signed in longer", and it seems we're not alone (see [#4520](https://github.com/logto-io/logto/issues/4520) and the recent [bump](https://github.com/logto-io/logto/issues/4520#issuecomment-4295100405)). But for SPAs, rotation doesn't seem to do anything for the grant lifetime — it looks more like a pure security feature (reuse detection). If we're reading this right, wouldn't that also mean users can get kicked out **mid-task** when the cap fires, since AT TTL is only 1 hour and the cap is at a fixed wall-clock moment? ### Describe what you'd like Logto to have Either of these would help: 1. **Tweak the docs** — say plainly that "Rotate refresh token" doesn't extend TTL for SPAs. Drop the "to enhance user experience" phrasing, or rewrite it to describe what rotation _actually_ buys for SPAs (security against stolen RTs via reuse detection), so devs don't keep walking into this. 2. **Bring back the toggle from [#4520](https://github.com/logto-io/logto/issues/4520)** — an opt-in "Renew refresh token TTL on rotation" per app, off by default, with a sane hard cap (1 year would match native / traditional web). Low-risk apps could trade a bit of security for much better UX.