BearerToken#duplicate cannot explicitly clear expires_at

## Summary

`BearerToken#duplicate` uses `options[:expires_at] || @expires_at`, so an explicit `expires_at: nil` is indistinguishable from omission. Callers cannot duplicate a token while deliberately clearing its expiration, although other duplicate options distinguish supplied values.

## Proposed correction

Use `options.fetch(:expires_at, @expires_at)` so omission preserves the source and explicit nil clears it. Candidate: `1e7f8db539bfda5da942e406c5563c66c2fac227` on 1.17.4/current `main` (`01431c9ecd59e1efc5d262694971ded925044fdc`).

The focused model covers omitted, replaced and explicitly cleared expiration. This is distinct from PR #552's `UserAuthorizer` nil-expiration path. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.

I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.