feat(desktop): log when Docker Desktop serves an expired token

[trungutt]

Why

When the models gateway rejects a request with a 401, the logs today can't answer the first triage question: was the token we forwarded already expired when Docker Desktop handed it to us, or was it locally valid and rejected upstream (e.g. revoked)? The only expiry-related warnings fire deep in the refresh path, so they are missing whenever a forced refresh is skipped (singleflight join, rate-limit window) or when it succeeds.

This adds a warning at the moment an expired token is received, before any recovery attempt:

WARN Docker Desktop served an expired token fingerprint=a1b2c3d4 expired_for=42m10s expires_at=2026-07-29T09:15:00Z

With it, log sequences become classifiable on their own:

stale session, stuck:      served an expired token -> Forcing a refresh -> did not deliver
                           a fresh token in time -> sending a token known to be expired
stale session, recovered:  served an expired token -> Forcing a refresh -> Recovered a fresh token
no such line before a 401: the token was locally valid; the rejection came from upstream

The fingerprint (non-reversible hash) distinguishes "same stale token served repeatedly" from "a different token each time"; expires_at is the raw exp claim, comparable against server-side request traces.