Authentication is often presented as a short sequence:

Accept a username and password.

Return a JWT.

Protect a few endpoints.

That is enough for a tutorial, but it is not an authentication lifecycle.