fix: validate access override expiry

[Tsammie]

Summary

• Added explicit expiresAt validation for createAccessOverride.
• Rejected malformed expiry values with a clear 400 validation error instead of allowing raw database errors.
• Made past-dated expiry behavior explicit by rejecting already-expired overrides.
• Added focused tests for valid, malformed, omitted/null, and past-dated expiry inputs.

Notes

This PR keeps the change focused on access override expiry validation. It does not change the Prisma schema, migrations, or unrelated service behavior.

Checks

• Malformed expiresAt values return a clear 400 error
• Past-dated expiresAt behavior is explicit and tested
• Valid future expiresAt values still work
• Omitted/null expiresAt behavior is preserved
• git diff --check

Closes #130

[Lakes41]

Do endeavour to pass workflow @Tsammie

[Lakes41]

This PR cannot be merged automatically because one or more workflow checks failed.

Please review the failed checks, push a fix, and wait for the workflows to pass.

After the checks pass and there are no merge conflicts, the automation can review it again.