fix refresh token

apps/jwt_auth/views.py

@@ -120,7 +120,9 @@ class CustomTokenRefreshView(PublicAuthView):
         refresh_value = serializer.validated_data['refresh']
         try:
             refresh = RefreshToken(refresh_value)
-            session = JwtToken.objects.select_for_update().select_related(
+            # Nullable user/workspace joins must not participate in PostgreSQL's
+            # row lock. The session alone serializes refresh-token rotation.
+            session = JwtToken.objects.select_for_update(of=('self',)).select_related(
                 'cuser_role__cuser', 'cuser_role__role_type', 'cuser_role__sys_ws',
             ).get(refresh=refresh_value, is_blocked=False)
         except (TokenError, JwtToken.DoesNotExist):