Set PAT expiration period

[agafgfafa]

PATs should not be indefinite. I suggest setting a default expiration of max 1 year, and also perhaps creating an option to allow users to set a reduced validity of tokens.

This would likely involve emailing users a courtesy notice of tokens that are about to expire (in, say, 1 week).

[agafgfafa]

By way of reference, NPM is limiting token life to 90 days.
https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/

[kineticsquid]

Yes, we're considering this now. IMO, we do the same as NPM and set expiration to <= 90 days.