feat: alert before a token the jobs use expires

[Bilb]

Adds token-expiry, a daily job (09:00 Melbourne, as sessionops) that posts to the alerts channel 14, 7 and 1 days before a token expires, and once when it has. Quiet otherwise; a new expiry or a rotated token starts its alerts over.

Token	Expiry from
GITHUB_PRS_TOKEN	GitHub's github-authentication-token-expiration response header
CLAUDE_CODE_OAUTH_TOKEN	A year after the job first saw it, tracked by a 12-hex-char SHA-256 fingerprint in its state. A token installed before the job ran takes its real issue date from [issued] in expiry.toml, which applies only while that fingerprint matches.
CROWDIN_API_TOKEN	/etc/session-ops/expiry.toml, by hand (no API exposes it); reported until it has a date or "never"

The Zendesk API token, Discord webhooks and the GitHub App key do not expire.

Trade-off: fingerprinting the Claude token means the unit loads zendesk.env, so the Zendesk secrets are in this unit's environment too, and the job is only ready on a host where zendesk.env has content.

Also: install.sh installs deploy/env/*.example, which now includes expiry.toml.example; a doc page at docs/jobs/token-expiry.md; the drop-in golden updated for the new job.

Deploying

install -m 644 /etc/session-ops/expiry.toml.example /etc/session-ops/expiry.toml
# set CROWDIN_API_TOKEN, and [issued.CLAUDE_CODE_OAUTH_TOKEN] with the fingerprint the dry run prints
git -C /opt/session-ops pull && /opt/session-ops/deploy/install.sh
systemd-run --pipe --wait -p User=sessionops \
  -p EnvironmentFile=/etc/session-ops/alerts.env -p EnvironmentFile=/etc/session-ops/github-prs.env \
  -p EnvironmentFile=/etc/session-ops/zendesk.env \
  /opt/session-ops/.venv/bin/session-ops-token-expiry --dry-run

Testing

• uv run python -m unittest discover -s tests -t .: 759 tests pass; ruff check clean.
• Local runs against the live GitHub API: the probe works, and a second run keeps the Claude token's first-seen date. The header format matches what angus's token returns (2027-10-02 03:00:00 UTC).