BearerToken#duplicate cannot explicitly clear expires_at #598

Summary

BearerToken#duplicate uses options[:expires_at] || @expires_at, so an explicit expires_at: nil is indistinguishable from omission. Callers cannot duplicate a token while deliberately clearing its expiration, although other duplicate options distinguish supplied values.

Proposed correction

Use options.fetch(:expires_at, @expires_at) so omission preserves the source and explicit nil clears it. Candidate: 1e7f8db539bfda5da942e406c5563c66c2fac227 on 1.17.4/current main (01431c9ecd59e1efc5d262694971ded925044fdc).

The focused model covers omitted, replaced and explicitly cleared expiration. This is distinct from PR #552's UserAuthorizer nil-expiration path. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.

I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.