fix(pat): honor server device flow expiry

[shangguanxuan633-lab]

Summary:

• consume the PAT service expiresInSeconds field
• use the same effective timeout for CLI display and device-flow polling deadline
• preserve the legacy 10 minute fallback for missing or invalid values
• reject and fall back when server expiry exceeds the 30-day DCF protocol/storage upper bound; this is input validation, not a second client-owned TTL

Tests:

• focused expiry resolver and handler tests
• DWS_PACKAGE_VERSION=0.0.0-test go test ./internal/app -count=1
• DWS_PACKAGE_VERSION=0.0.0-test go test ./...
• go build -o /tmp/dws-dcf-expiry-cli-build ./cmd