fix(oauth): set ExpiresAt from JWT exp on stored ID tokens (#549)

[QuentinBisson]

Closes part of #549.

storeIDTokenForSSO was persisting the proxy-side ID token with zero ExpiresAt, so IsExpiredWithMargin treated it as never-expiring even after the embedded JWT was past its exp. After ~30 minutes idle, downstream servers receive an expired token, reject with 401, and the SSE listeners loop on 1-second retries flooding the logs.

Reads the JWT's exp via pkgoauth.Expiry (introduced in #619) and persists it as the entry's ExpiresAt. JWTs without a parseable exp are refused at storage time and logged at warn level — the alternative would be to land a zero-ExpiresAt entry, recreating the same leak. muster's own ID tokens are minted by mcp-oauth and always carry exp, so this only fires on misconfiguration.

Tests cover the three branches: JWT with exp → stored with correct ExpiresAt; unparseable token → refused; JWT missing exp → refused.

This closes the silent-forwarding leg. On-demand upstream refresh (option b in the issue) needs an mcp-oauth API addition and will be filed as a follow-up.

[QuentinBisson]

Self-review wrap-up — ready for an external pair of eyes.

Why this should merge: Real fix for #549. storeIDTokenForSSO was persisting the proxy-side ID token with zero ExpiresAt, so IsExpiredWithMargin treated it as never-expiring even after the embedded JWT was past exp. After ~30 minutes idle, downstream servers receive an expired token, reject with 401, and the SSE listeners loop on 1-second retries flooding the logs.

Reads the JWT's exp via pkgoauth.Expiry (from #619) and persists it as the entry's ExpiresAt. Tokens without a parseable exp are refused at storage time and logged at warn — landing a zero-ExpiresAt entry would recreate the same leak. muster's own ID tokens are minted by mcp-oauth and always carry exp, so the refuse path only fires on misconfiguration.

Test trio: JWT with exp → stored with correct ExpiresAt; unparseable token → refused; JWT missing exp → refused.

Self-review pass applied:

• Updated PR body to match the code (previously claimed a "graceful fallback" that doesn't exist — the code refuses, the CHANGELOG says refuses, the tests assert refuses).
• Switched to pkgoauth.Expiry (replacing the now-removed local getTokenExpiryTime from refactor(oauth): consolidate JWT payload parsing into pkg/oauth/jwt.go #619). Stack-order resolved.
• Dropped narrative Issue #549 references from the godoc and test comment.

This closes the silent-forwarding leg. On-demand upstream refresh (option b in the issue) will be a follow-up. CI green.

[paurosello]

Tight scoped fix; refuse-to-store-on-parse-error matches issue option (a). Stacked on #619 — must merge that first.