Negative remaining duration panics in ImpersonatedTokenProvider when expire_time is in past

Unconfirmed. This is the result of a search with Claude, may be a false positive.

In `src/auth/src/credentials/impersonated.rs`, access token expiration is calculated from the server's `expireTime`:

https://github.com/googleapis/google-cloud-rust/blob/f02b42c2ac5720334cd2b5335824bd4166264527/src/auth/src/credentials/impersonated.rs#L1036-L1037

If the server response contains an `expireTime` that is slightly in the past (e.g. due to clock skew or delayed response), `remaining_duration` is a negative `time::Duration`.

Converting a negative `time::Duration` into a `std::time::Duration` fails, causing `remaining_duration.try_into().unwrap()` to panic at runtime rather than returning a `CredentialsError`.

Start in src/auth/src/credentials/impersonated.rs at the cited expiration calculation around lines 1036-1037, and trace how the remaining duration is converted. Check the relevant impersonated credential behavior and ensure a server expiration in the past does not panic; done means it returns a CredentialsError or otherwise follows the provider's existing error handling.

Written by the indexing model from the issue text.