Clarify bearer token default expiry units

[devboell]

Scope

Make the default bearer token expiry in Phobos explicit and unambiguous.

Problem

Phobos falls back to a numeric bearer expiry when no expiry is provided. jsonwebtoken interprets numeric expiresIn values as seconds, while the current code/comment appears to imply a different unit.

Outline

• Inspect current lib/bearer.js default expiry.
• Replace the ambiguous numeric default with an explicit duration, for example 7d, or otherwise correct/document the unit.
• Add focused tests for default expiry behavior.
• Preserve existing behavior when callers pass an explicit expiry.

Parent

Refs mgmco/bugs#3708