“Header Access, Cookie Refresh — A practical JWT auth playbook for Django + TypeScript SPAs.” It covers:

• Architecture & threat model
  
• Exact cookie/CORS/CSRF settings to use
  
• Backend endpoint contracts (login/refresh/logout)
  
• Frontend behavior (single-flight refresh, one-retry rule, per-tab storage)
  
• Security headers (CSP, etc.), ops hygiene, tests, pitfalls, and a print-ready checklist