ak-agent TimeDelta conversion problem with v0.60.1

Stumbled over an interesting failure in `ak-agent` (v0.60.1) today.

```
couldn't convert duration TimeDelta { secs: -282463, nanos: 949346120 } to std
```

Seems like something that shouldn't happen, and is hopefully a fairly easy fix. :smile:

---

First weirdness was getting error output in response to `ak whoami`:

```
$ ak whoami
Error running command: whoami RPC failed

Caused by:
code: 'Internal error', message: "Invalid status code for whoami request"

Location:
ak-cli/src/commands/whoami.rs:20:10
```

Checking the status of the running `ak-agent` showed a problem when renewing the token, and shows the above mentioned TimeDelta conversion problem:

```
$ systemctl --user status ak-agent
● ak-agent.service - authentik Agent
Loaded: loaded (/etc/xdg/systemd/user/ak-agent.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2026-08-24 11:44:21 AEST; 5h 21min ago
Main PID: 2863 (ak-agent)
Tasks: 17 (limit: 37704)
Memory: 14.9M
CPU: 9.988s
CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/ak-agent.service
└─2863 /usr/bin/ak-agent

Aug 24 17:05:43 somepc ak-agent[2863]: somepc ak-agent[2863]: write_commands; commands=[Auth(Some(External), Some([49, 48, 48, 48]))] extra_bytes=None
Aug 24 17:05:43 somepc ak-agent[2863]: somepc ak-agent[2863]: read_command;
Aug 24 17:05:43 somepc ak-agent[2863]: somepc ak-agent[2863]: read_commands; n_commands=1
Aug 24 17:05:43 somepc ak-agent[2863]: somepc ak-agent[2863]: write_commands; commands=[NegotiateUnixFD, Begin] extra_bytes=Some([108, 1, 0, 1, 0, 0, 0, 0, 11, 0, 0, 0, 109, 0, 0, 0, 1, 1, 111, 0, 21, 0, 0, 0, 4>
Aug 24 17:05:43 somepc ak-agent[2863]: somepc ak-agent[2863]: read_commands; n_commands=1
Aug 24 17:05:43 somepc ak-agent[2863]: somepc ak-agent[2863]: finished call grpc.service=agent_auth.AgentAuth grpc.method=WhoAmI grpc.code=Internal grpc.time_ms=223.699141 peer.pid=66617 id=None
Aug 24 17:05:54 somepc ak-agent[2863]: somepc ak-agent[2863]: renewing token now profile="default"
Aug 24 17:05:55 somepc ak-agent[2863]: somepc ak-agent[2863]: failed to renew token: token renewal failed: {"error": "invalid_grant", "error_description": "The provided authorization grant or refresh token is in>

Location:
ak-agent/src/token/profile.rs:251:13 profile="default"
Aug 24 17:05:55 somepc ak-agent[2863]: somepc ak-agent[2863]: couldn't convert duration TimeDelta { secs: -282463, nanos: 949346120 } to std, defaulting to 30s: OutOfRangeError(())
Aug 24 17:05:55 somepc ak-agent[2863]: somepc ak-agent[2863]: profile: renewing token in 30s profile="default"
```

Restarting `ak-agent` doesn't seem to help, it just displays similar errors about failing to renew the token. Haven't investigated that yet, may not be an ak-agent problem.

The TimeDelta conversion problem though seems like it'll be an easy fix once someone is aware it needs looking at. :smile:

Start at ak-agent/src/token/profile.rs:251 and trace the token-renewal path that logs the TimeDelta conversion; compare it with ak-cli/src/commands/whoami.rs:20 to understand the reported user-facing failure. Reproduce the renewal failure from the supplied logs and verify that the conversion path no longer emits the OutOfRangeError while the renewal and status behavior are correct.

Written by the indexing model from the issue text.