REST API Builder with Authentication

Build a production-ready REST API with these specifications:

API purpose: [describe what the API does]
Main resources/entities: [list 2–3, e.g., users, posts, products]
Database: [PostgreSQL / MongoDB / SQLite]
Language/framework: [Node.js/Express / Python/FastAPI / Go]
Authentication: JWT (access + refresh tokens)

Generate the complete API including:

1. Project structure with all files listed
2. Authentication endpoints:
   - POST /auth/register (with password hashing)
   - POST /auth/login (returns JWT)
   - POST /auth/refresh
   - POST /auth/logout

3. For each resource: full CRUD endpoints
   - GET /[resource] (list with pagination, filtering, sorting)
   - GET /[resource]/:id
   - POST /[resource] (with validation)
   - PUT /[resource]/:id (with ownership check)
   - DELETE /[resource]/:id (soft delete)

4. Middleware: auth guard, rate limiter (100 req/15min), request logger, error handler
5. Input validation with descriptive error messages
6. Environment variable configuration (.env.example)

Write clean, commented code following REST best practices.