Selecting "No expiration" when creating an access key via the UI produces a token that expires after 1 hour.
The root cause appears to be that the Kubernetes TokenRequest API defaults to 1h expiration when ExpirationSeconds is omitted from the TokenRequestSpec. It seems the ServiceAccountToken would have to be used instead as the TokenRequest API inherently (and purposefully) does not allow tokens that aren't time-bound.