Missing expires_in in token response

Although I see `expires_in` being checked in tests, I do not see it returned with the access token.

Is this an oversight?

Start by reading the tests that check for expires_in and trace the access-token response they exercise. Confirm where the token response is assembled, then verify the completed behavior by running the relevant test suite and checking that the response includes expires_in.

Written by the indexing model from the issue text.