swarm-nats-auth: give issued user JWTs an exp

The user JWT the callout issues carried no exp, so nats-server armed no
expiry timer and a connection kept its grant until the client dropped it:
a deleted or re-minted agent queue secret, a removed OIDC client or an
expired access token never reached a live connection.

Every issued user JWT now expires at the presented OIDC token's exp
(read from the introspection answer) or an hour after issue, whichever
is sooner; the agent queue-secret path has no exp of its own and gets
the hour. Every queue client reconnects through an auth callback that
re-reads or re-mints its credential, so the forced reconnect presents a
current one.

Fixes #5432

swarm-nats-auth/README.md

@@ -73,6 +73,11 @@ timeout`**, with a test asserting the relation — a responder that answers
   It is one request's whole budget: when the `IdP` refuses the responder's own
   secret, the re-read from the store and the one retry fit inside it, or the
   request is denied and the re-read lands for the next one.
+- **Every issued user JWT expires**, at the presented OIDC token's own `exp`
+  or an hour after issue, whichever is sooner. nats-server closes the
+  connection at that point, and the client's reconnect comes back through
+  this responder. That reconnect is what makes a deleted or re-minted
+  credential reach an open connection.
 
 ## What the tests do and do not cover