[Security] Cluster Authentication Token Not Rotated - Long-lived Tokens Risky

## Description
Cluster authentication tokens are long-lived and never rotated. Tokens don't expire, and there's no rotation mechanism. Compromised tokens provide permanent access to the cluster.

## Steps to Reproduce
1. Administrator generates cluster auth token
2. Token used for service authentication
3. No expiration set on token
4. No rotation scheduled
5. Token compromised through audit log exposure
6. Attacker has permanent access

## Environment Information
- Authentication: Token-based
- Token lifetime: Unlimited
- Rotation: Not implemented
- Management: Manual only

## Expected Behavior
- Token expiration: 30-90 days
- Automatic rotation mechanism
- Revocation capability
- Audit trail of token usage

## Actual Behavior
- Tokens never expire
- No automatic rotation
- No revocation
- Permanent access if compromised

## Code Reference
- File: `server/api/auth.go`
- Method: `GenerateToken()` - no expiration
- Missing: Token TTL
- Missing: Rotation scheduler

## Additional Context
Level 1 security issue. Fix requires:
- Adding token expiration
- Implementing rotation scheduler
- Token revocation mechanism
- Audit logging of token changes

## Suggested Labels
`security`, `authentication`, `token-rotation`, `credential-management`, `critical`