swarm-nats-auth: give issued user JWTs an exp

The user JWT the callout issues carried no exp, so nats-server armed no
expiry timer and a connection kept its grant until the client dropped it:
a deleted or re-minted agent queue secret, a removed OIDC client or an
expired access token never reached a live connection.

Every issued user JWT now expires at the presented OIDC token's exp
(read from the introspection answer) or an hour after issue, whichever
is sooner; the agent queue-secret path has no exp of its own and gets
the hour. Every queue client reconnects through an auth callback that
re-reads or re-mints its credential, so the forced reconnect presents a
current one.

Fixes #5432

swarm-queue-client/src/lib.rs

@@ -16,9 +16,10 @@
 //! Two things about that shape drive everything here:
 //!
 //! - **A token expires.** Authelia issues `client_credentials` access tokens
-//!   with `expires_in: 3599`. Authentication happens at CONNECT, so a
-//!   long-lived connection is fine — but a *reconnect* an hour later needs a
-//!   token that was minted an hour later.
+//!   with `expires_in: 3599`. Authentication happens at CONNECT, and the user
+//!   JWT `swarm-nats-auth` issues expires no later than the token does, so
+//!   the server closes the connection within the hour and the *reconnect*
+//!   needs a token minted after it.
 //! - **`async-nats` re-runs an auth callback per connection attempt** (it is
 //!   handed that attempt's nonce). So the refresh belongs in the callback and
 //!   not in a timer: there is no window in which the client presents a token