feat: support expiring role assignments

[Tsammie]

Summary

• Added optional expiresAt support to role assignment input.
• Threaded expiresAt through role assignment creation so time-limited roles can be persisted.
• Added validation for invalid expiresAt values using the existing API validation style.
• Added tests covering permanent, active time-limited, expired, and invalid expiry scenarios.

Notes

This PR keeps the change focused on role assignment expiry support. It does not refactor the policy engine or address the existing duplicate role-resolution logic separately.

Checks

• Permanent role assignments remain unaffected
• Future expiresAt assignments can grant access
• Expired role assignments stop granting access
• Invalid expiresAt input is rejected
• git diff --check

Closes #138

[Lakes41]

This PR cannot be merged automatically because one or more workflow checks failed.

Please review the failed checks, push a fix, and wait for the workflows to pass.

After the checks pass and there are no merge conflicts, the automation can review it again.