4.4 Add invitation expiration validation

[marwannettour]

Parent epic: #310

Summary

Reject trusted-session invitations after expiration.

Requirements

• Compare the current time with payload.ExpiresAt.
• Return a clear user-facing expired result.
• Send an Expired status back to the initiator where the relay flow supports it.
• Apply any clock tolerance consistently if introduced.

Acceptance criteria

• Expired invitations are refused.
• Non-expired invitations continue through validation.
• Expiration failures are test-covered.