Function isSessionExpired

Check whether an ISO 8601 expiry timestamp has passed or is malformed.

Semantics:

• Empty string → false (no expiry recorded yet, e.g. fresh instance)
• Unparseable value → true (defensive: corruption is treated as expired so the caller reauthenticates instead of silently trusting stale state)
• Valid ISO date in the past → true
• Valid ISO date in the future → false (subject to aheadMs below)

Pre-emptive refresh: pass aheadMs > 0 to treat a token as expired while it still has that much lifetime left. This lets ensureSession renew the session before the real expiry tick, so no request ever pays the full re-auth round-trip in its critical path. The common value is 5 minutes (5 * 60 * 1000).

Offset-less ISO strings — the format some upstreams persist their expiry in — are interpreted in the supplied zone. Without a zone, the runtime's system timezone is used. Strings with an explicit Z or ±HH:MM offset are parsed as absolute Temporal.Instants, ignoring zone.