Summary

• enforce the effective default challenge expiry when verifying credentials
• reject credentials that omit expires even when VerifyParams.Expires was not explicitly set
• add a regression test for the default-expiry path

Why

VerifyOrChallenge issues challenges with a default five-minute expiry when VerifyParams.Expires is empty. Verification should enforce that same effective expiry policy. Previously the missing-expires check only ran when params.Expires was explicitly set, so credentials without an expires field could pass the default-expiry path.

Verification

• go test ./pkg/server -run TestVerifyOrChallenge_RejectsMissingDefaultExpires -count=1 failed before the fix
• go test ./pkg/server -run TestVerifyOrChallenge -count=1
• go test ./...