* Purge expired ext.Tokens hourly

Expired ext.Tokens were never cleaned up automatically. The auth path
rejected them on use, but their backing Secrets stayed in the
cattle-tokens namespace. Rancher already ran an hourly purge for v3.Tokens
and SamlTokens but not for ext.Tokens.

The purge daemon now sweeps ext.Tokens on the same hourly schedule
alongside v3.Tokens and SamlTokens. Cleanup for each token kind returns
a count and an error, and per-token failures are joined and surfaced to
the daemon rather than logged inline.

* Populate Wrangler client in the auth server's management context

The auth server's leader-election path built a ManagementContext
without a Wrangler client. Nothing on that path needed Wrangler
before.

The Wrangler client is now populated from the ScaledContext.

* Start the token purge daemon at most once per process

  The daemon's startup path is invoked from two separate leader-election
  callbacks in the same process. Both fire on single-instance Rancher
  deployments and each spins up an independent purge goroutine.

  The startup path is now guarded by a sync.Once. Subsequent invocations
  are a no-op.

* Use time.Duration for TTL and purge interval

  The purge daemon's interval and the test helpers' TTL values were
  raw int64s (seconds and milliseconds respectively). Call sites
  converted at each use.

  The interval and test TTLs are now typed as time.Duration.
  Conversion to milliseconds happens once at the boundary where the
  stored value still expects int64.