Client is not properly notified with AUTH_FAILED when using auth-gen-token and reneg-sec

Describe the bug
AUTH_FAILED message not sent from server to client after token expiration when using auth-gen-token and reneg-sec settings on the server. Instead it is sent after auth-gen-token + (reneg-sec * 2) which leads to a stalled client until AUTH_FAILED is received.

To Reproduce
use both auth-gen-token and reneg-sec

Expected behavior
The AUTH_FAILED message should be sent to the client as soon as the token is expired, or ideally the the client would be asked to re-authenticate before the old token expires and a new token is pushed to the client (as the man page eludes to).

Version information (please complete the following information):

• OS: Debian 11 server, MacOS 13.0.1 and Windows 10 22H2 clients
• OpenVPN version: 2.5.1-3 server, 2.5.7 (Viscosity) clients

Additional context
The 2.5 openvpn man page states for auth-gen-token:
"The token will expire either after the configured lifetime of the token is reached or after not being renewed for more than 2 * reneg-sec seconds."

The token still expires after the specified auth-gen-token lifetime so reneg-sec should not be factored into the AUTH_FAILED control message unless there's a way to prompt for re-authentication before expiration. Perhaps these two options should be completely independent.

Start by reproducing the issue with auth-gen-token and reneg-sec enabled, then trace the server handling of token expiry and AUTH_FAILED delivery. Compare the configured token lifetime with the reneg-sec timing; done when the client receives AUTH_FAILED at token expiry or the intended re-authentication behavior is established and covered by a regression test.