fix: remove double token expiry buffer

[marcusolsson]

Issue 5 from TODO.md

The token expiry buffer (ACCESS_TOKEN_EXPIRY_BUFFER_MS = 60s) was applied at both storage time and check time, creating a ~120s total headroom.

For a 300s token:

• Before: stored expires = t0 + 240s, then accessTokenExpired() triggers at t0 + 180s → 40% waste
• After: stored expires = t0 + 300s (raw), then accessTokenExpired() triggers at t0 + 240s → single 60s buffer

Changes

• pkce-flow.ts: Remove - ACCESS_TOKEN_EXPIRY_BUFFER_MS from exchangeCodeForTokens.
• token.ts: Remove - ACCESS_TOKEN_EXPIRY_BUFFER_MS from refreshAccessTokenInternal.
• auth.ts: No change — accessTokenExpired() already correctly compares against now + BUFFER, which is the right single point for the buffer.
• Cleans up unused imports of ACCESS_TOKEN_EXPIRY_BUFFER_MS.
• Adds src/plugin/auth.test.ts with 5 tests for accessTokenExpired().

Refs: TODO.md Issue 5