feat(security): apikey --expires CLI flag + dashboard expiry/staleness badge (SEC-10 polish)

Gateway-side follow-up to the shared auth-lib expiry core (delivered via G-2):

- apikey create-key gains optional --expires — absolute ISO-8601 UTC or relative
  <N>d/<N>h from now; omitted means non-expiring (opt-in, unchanged default).
  Threaded ApiKeyAdminCommand -> parser -> runner into the library's
  CreateKeyAsync(..., expiresUtc, ...). list-keys shows an expiry column and an
  active/expired/revoked status.
- Dashboard API Keys page surfaces expiry: an Expires column (Never when unset)
  and a status badge reading Expired (red) / Expiring (<=7d, amber) / Revoked /
  Active. DashboardApiKeySummary.ExpiresUtc projected in DashboardSnapshotService;
  StatusBadge maps the new states.

Tests: parser (absolute/relative/invalid/none) + end-to-end past-expiry rejection
through the live verifier; dashboard summary suite green. Docs: Authentication.md
(verification-flow expiry step, CLI table + examples, dashboard badge).

Closes the tracked SEC-10 polish (SEC-10 core was already Done).

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Components/Pages/ApiKeysPage.razor

@@ -164,6 +164,7 @@ else
                             <th scope="col">Constraints</th>
                             <th scope="col">Created</th>
                             <th scope="col">Last Used</th>
+                            <th scope="col">Expires</th>
                             @if (CanManageApiKeys)
                             {
                                 <th scope="col">Actions</th>
@@ -175,12 +176,13 @@ else
                         {
                             <tr>
                                 <td><code>@key.KeyId</code></td>
-                                <td><StatusBadge Text="@(key.RevokedUtc is null ? "Active" : "Revoked")" /></td>
+                                <td><StatusBadge Text="@KeyStatus(key)" /></td>
                                 <td>@DashboardDisplay.Text(key.DisplayName)</td>
                                 <td>@DashboardDisplay.Text(string.Join(", ", key.Scopes.Order(StringComparer.Ordinal)))</td>
                                 <td>@DashboardDisplay.Text(ConstraintText(key.Constraints))</td>
                                 <td>@DashboardDisplay.DateTime(key.CreatedUtc)</td>
                                 <td>@DashboardDisplay.DateTime(key.LastUsedUtc)</td>
+                                <td>@(key.ExpiresUtc is null ? "Never" : DashboardDisplay.DateTime(key.ExpiresUtc))</td>
                                 @if (CanManageApiKeys)
                                 {
                                     <td>
@@ -468,6 +470,35 @@ else
         }
     }
 
+    // Window before an expiry within which a key is flagged as "Expiring" (warn) rather than "Active".
+    private static readonly TimeSpan ExpiringSoonWindow = TimeSpan.FromDays(7);
+
+    // Status vocabulary understood by StatusBadge: Revoked wins over expiry; a past expiry is Expired
+    // (bad), an expiry inside ExpiringSoonWindow is Expiring (warn), otherwise Active (SEC-10).
+    private static string KeyStatus(DashboardApiKeySummary key)
+    {
+        if (key.RevokedUtc is not null)
+        {
+            return "Revoked";
+        }
+
+        if (key.ExpiresUtc is { } expiresAt)
+        {
+            DateTimeOffset now = DateTimeOffset.UtcNow;
+            if (expiresAt <= now)
+            {
+                return "Expired";
+            }
+
+            if (expiresAt - now <= ExpiringSoonWindow)
+            {
+                return "Expiring";
+            }
+        }
+
+        return "Active";
+    }
+
     private static string ConstraintText(ApiKeyConstraints constraints)
     {
         if (constraints.IsEmpty)

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Components/Shared/StatusBadge.razor

@@ -9,8 +9,8 @@
     {
         "Ready" or "Healthy" or "Active" => StatusState.Ok,
         "Creating" or "StartingWorker" or "WaitingForPipe" or "InitializingWorker" or "Closing"
-            or "Stale" or "Degraded" => StatusState.Warn,
-        "Faulted" or "Unavailable" => StatusState.Bad,
+            or "Stale" or "Degraded" or "Expiring" => StatusState.Warn,
+        "Faulted" or "Unavailable" or "Expired" => StatusState.Bad,
         _ => StatusState.Idle,
     };
 }

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardApiKeySummary.cs

@@ -9,4 +9,5 @@ public sealed record DashboardApiKeySummary(
     ApiKeyConstraints Constraints,
     DateTimeOffset CreatedUtc,
     DateTimeOffset? LastUsedUtc,
-    DateTimeOffset? RevokedUtc);
+    DateTimeOffset? RevokedUtc,
+    DateTimeOffset? ExpiresUtc = null);

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardSnapshotService.cs

@@ -273,7 +273,8 @@ public sealed class DashboardSnapshotService : IDashboardSnapshotService
                     Constraints: ApiKeyConstraintSerializer.Deserialize(key.ConstraintsJson),
                     CreatedUtc: key.CreatedUtc,
                     LastUsedUtc: key.LastUsedUtc,
-                    RevokedUtc: key.RevokedUtc))
+                    RevokedUtc: key.RevokedUtc,
+                    ExpiresUtc: key.ExpiresUtc))
                 .ToArray();
 
             Volatile.Write(ref _apiKeySummaries, summaries);