feat(auth): support optional expiry for bot API tokens

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/repo/api_token.rs

@@ -2,6 +2,7 @@
 //! token; the raw value is shown to the user once at creation and never
 //! stored.
 
+use chrono::{DateTime, Utc};
 use sqlx::PgPool;
 use uuid::Uuid;
 
@@ -13,17 +14,19 @@ pub async fn create(
     user_id: Uuid,
     name: &str,
     token_hash: &[u8],
+    expires_at: Option<DateTime<Utc>>,
 ) -> AppResult<ApiToken> {
     let row = sqlx::query_as::<_, ApiToken>(
         r#"
-        INSERT INTO api_tokens (user_id, name, token_hash)
-        VALUES ($1, $2, $3)
-        RETURNING id, user_id, name, token_hash, created_at, last_used_at
+        INSERT INTO api_tokens (user_id, name, token_hash, expires_at)
+        VALUES ($1, $2, $3, $4)
+        RETURNING id, user_id, name, token_hash, created_at, last_used_at, expires_at
         "#,
     )
     .bind(user_id)
     .bind(name)
     .bind(token_hash)
+    .bind(expires_at)
     .fetch_one(pool)
     .await?;
     Ok(row)
@@ -32,9 +35,10 @@ pub async fn create(
 pub async fn find_active(pool: &PgPool, token_hash: &[u8]) -> AppResult<Option<ApiToken>> {
     let row = sqlx::query_as::<_, ApiToken>(
         r#"
-        SELECT id, user_id, name, token_hash, created_at, last_used_at
+        SELECT id, user_id, name, token_hash, created_at, last_used_at, expires_at
         FROM api_tokens
         WHERE token_hash = $1
+          AND (expires_at IS NULL OR expires_at > now())
         "#,
     )
     .bind(token_hash)