Evaluates a credential's expiry against the clock and the configured policy.
This is the single source of truth for "is this credential expired?" — every
caller, in this package and outside it, should route through here rather than
comparing dates by hand, so that the warning window, grace period, and
unparseable-value handling stay consistent.
Parameters
expiresAt: string|Date
The credential's ExpiresAt value, in any of its transport shapes.
Evaluates a credential's expiry against the clock and the configured policy.
This is the single source of truth for "is this credential expired?" — every caller, in this package and outside it, should route through here rather than comparing dates by hand, so that the warning window, grace period, and unparseable-value handling stay consistent.