Verifies a refresh token and checks its validity against the user's stored tokens.
The refresh token to verify.
The user model (should support findById and save).
A Promise that resolves with the user if valid, or rejects with an error message.
Verifies a refresh token and checks its validity against the user's stored tokens.