Function needs_refresh 

pub fn needs_refresh(value: &Value, now: u64) -> bool

Whether a std:oauth2 field’s value should be renewed before it is served.

A value with no std:expires-at is not renewed. ACT-CONSTANTS §8.3 has a consumer read a missing expiry as “no known expiry”, and a host that treated absence as “expired” would refresh on every single call — burning a rotation each time against servers that rotate.