Issued JWTs never expire

Every token this service issues is supposed to expire after TokenTTL (24 hours) -- that's the entire safety net if a token is ever leaked (a logged request, a compromised device, a browser history entry). Right now, issued tokens carry no expiry at all, so a token that leaks today remains a fully valid credential forever -- there is no way to force it to stop working short of rotating the JWT secret for every user at once. This silently removes a core security control without any visible symptom (everything looks like it's working -- tokens are issued, tokens are accepted -- right up until someone needs the expiry to have actually protected them).

GenerateToken builds the token's Claims without setting ExpiresAt. The JWT library used here (golang-jwt/jwt/v5) only validates an expiry claim if one is present -- it does not require every token to carry one -- so a token with no exp claim at all is treated by ParseToken as permanently valid, no matter how old it is.

Call auth.GenerateToken(secret, someUserID). Parse the resulting token back (e.g. with jwt.ParseWithClaims) and inspect claims.ExpiresAt.

Expected: ExpiresAt is non-nil, set to roughly 24 hours from now.

Actual: ExpiresAt is nil -- no expiry was ever set.

This is a well-known, real JWT footgun: an absent exp claim isn't a validation failure by default in most JWT libraries (including this one) -- it's simply treated as "no expiry constraint to check," which silently converts a supposedly short-lived credential into a permanent one. It requires no malformed input, no attacker action, and no visible error to trigger -- it's just a missing field in a struct literal.

Compare the Claims struct literal built inside GenerateToken against the TokenTTL constant and the RegisteredClaims fields already being set alongside it (IssuedAt is there -- what's the equivalent field for when the token stops being valid?).