feat(bouncer): stamp auth_time at sign-in and carry it unchanged through refresh (C-CR-02)

- MintAudience stamps auth_time equal to iat; refreshAudience copies the
  presented token's value and never renews it (absent stays absent)
- bouncer.ClaimAuthTime and bouncer.VerifyAuthTime for plugins, with the
  same signature, audience and expiry checks as VerifyClaims
- TestAuthTimeSmoke traces mint, refresh and read

modules/bouncer/refresh.go

@@ -136,7 +136,10 @@ func refreshAudience(secret, tokenString, audience string, allowMissing bool, re
 			return "", err
 		}
 	}
-	next, _, err := MintAudience(secret, sub, issuerURL, ttl, audience)
+	// The rotated token keeps the sign-in time of the presented one: refresh
+	// is not a sign-in. A token without auth_time stays without it.
+	authTime, _ := claimTime(claims, ClaimAuthTime)
+	next, _, err := mintAudience(secret, sub, issuerURL, ttl, audience, time.Now(), authTime)
 	if err != nil {
 		return "", err
 	}