Function verify_signed_at 

pub fn verify_signed_at(
    env: &SignedRoomMessage,
    now_ms: i64,
    window_ms: i64,
) -> Result<(RoomMessage, String)>

Same as verify_signed but with an explicit clock and window — kept public for tests that want to exercise the replay-window logic deterministically without a SystemTime detour.