Make token refresh failures actionable when the system clock is incorrect

### Problem

When the system clock is ahead, token verification can fail because the token appears expired. During screen unlock, GDM displays only:

> Failed to refresh token

The logs show:

> Failed to refresh token: could not verify token: oidc: token is expired (Token Expiry: 2026-08-24 14:45:12 +0200 CEST)

This does not explain the likely cause or help the user recover.

### Expected behavior

- The unlock error indicates that the system time may be incorrect.
- The message tells the user to check or correct the system time and try again.
- Logs show the token expiry and current time in human-readable form.

Start at the screen-unlock token-refresh error path and the corresponding token-verification logging path in authd. Reproduce the failure with the system clock ahead, then verify that the unlock message recommends checking the system time and that logs include the token expiry and current time in human-readable form.

Written by the indexing model from the issue text.