Docs: Document token lifecycle, capping mechanisms, and default TTLs

[teemow]

Summary

• Expands docs/operations/security.md from a stub into a comprehensive token lifecycle guide covering the dual token loop (agent-muster and muster-Dex), access token capping via capTokenExpiry, refresh token alignment with Dex's absoluteLifetime, and all default TTL values
• Adds an Access Token TTL section to docs/reference/configuration.md explaining the capping mechanism and clarifies the rolling-vs-absolute distinction in the session duration warning
• Improves the Token Expired troubleshooting section in docs/reference/cli/auth.md with explanations of what "Expires" and "Session" mean, and cross-references to the new security guide

Context

Analysis of the token lifecycle (see token TTL analysis plan) identified that while the code correctly aligns muster's default TTLs with Dex (30m access tokens, 30d session duration), the documentation didn't explain the capping mechanism, the dual token loop, or the default values. The existing docs warned about the rolling-vs-absolute mismatch but treated it purely as a configuration concern without explaining the underlying architecture.

Test plan

• Verify all cross-references between the three updated docs resolve correctly
• Verify mermaid diagram renders in GitHub markdown preview

Made with Cursor