Test-mode User expiry (expires_at) #30

Specified on 2026-10-20 in Auth → Test-mode Users → Lifetime, but not built. Until it is, test-mode Users last until the 30-day purge. This is the only spec'd API behavior that isn't implemented yet.

The full step-by-step build is in plan-remaining.md → Test-mode User expiry. In order:

• Migration 0005_test_user_expiry: users.expires_at, users.expired_processed_at, a backfill of created_at + 30 days, check constraints, a partial index, and test_user_expired added to the session and device reason checks
• Creation (createUser): 24-hour default, range check (≥ 15 min, ≤ created_at + 30 days) returning expires_at_out_of_range, and live creates rejected with live_user
• Per-request enforcement in principal.go: 403 test_user_expired on login, refresh, app-tokens, oauth/token, and mfa/verify
• Cap the access token exp, the app token exp, and the session's absolute_expires_at at expires_at
• PATCH /v1/users/{id} expires_at (users.manage only); extending an expired User fires access.granted (test_user_extended)
• Expiry sweep in entitlement-sweep: revoke sessions, deactivate devices, access.revoked, the user.expired webhook and audit event, then set expired_processed_at
• Exclude expired Users from the test-mode covered-member count
• OpenAPI: expires_at on User, create, signup, and patch; the new enum values; bump info.version; make gen
• Integration tests (listed in the plan)
• Docs: remove the "Not yet built" line from the 2026-10-20 Changelog entry and add a "built" entry