Function is_expired_with_margin 

pub fn is_expired_with_margin(expires_ms: u64, margin_ms: u64) -> bool

True if expires_ms is already past, or within margin_ms of now.

The margin absorbs clock skew + request latency so a client refetches slightly early rather than presenting a token that dies mid-flight.