fix(auth): skip renewal for non-expiring sandbox JWTs

[pimlock]

Summary

Stop the sandbox supervisor from renewing non-expiring local session JWTs roughly once per second. These tokens use exp = 0, which the refresh scheduler treated as already expired even though the gateway treats it as non-expiring.

Currently, tokens with exp = 0 cause a refresh every second, because the "is token expired" condition is met at all times.

Related Issue

No issue required: this is an obvious localized regression in the sandbox JWT refresh scheduler.

Changes

• Stop the periodic refresh loop when the gateway session JWT has exp = 0.
• Update the refresh-delay regression test to cover the non-expiring case while retaining coverage for expiring and expired tokens.
• Document the behavior in the gateway architecture and configuration reference.

Testing

• mise run pre-commit passes
• mise run test passes, including the updated renewal test
• OPENSHELL_E2E_DOCKER_TEST=sandbox_lifecycle mise run e2e:rust passes: CLI conformance and 15 sandbox lifecycle tests

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Architecture docs updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3686.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for ea90ab9. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.