Function token_needs_rotation 

pub fn token_needs_rotation(cred: &ServerCredential) -> bool

Returns true if the credential’s stored expiry is within the next [ROTATION_WINDOW_SECS] seconds.

Reads cred.expires_at (RFC 3339) rather than the token bytes directly: Biscuit tokens are intentionally opaque, but we already cache the expiry alongside the token at issue time, which is the source of truth the CLI needs for rotation decisions. Returns false on any parse failure so a stale credential row doesn’t block normal CLI operation.