Add structured log for each expired JWT attempt including the wallet address and how long ago the token expired

[Chucks1093]

Summary

Expired token rejections are currently silent beyond the 401 response. A warn-level log on each expired token attempt would help operators identify wallets that are not refreshing tokens correctly and detect patterns of replayed or stale credentials.

Scope

• Emit a warn-level log when a request is rejected due to an expired JWT with fields: wallet, expired_at, expired_seconds_ago, endpoint, ip_address
• expired_seconds_ago is the difference between now and the token's exp claim in seconds
• Log emitted once per rejected request, not per middleware layer
• Do not log the raw token string

Acceptance Criteria

• Warn log emitted on every expired token rejection with all five fields
• expired_seconds_ago correctly computed and always positive
• Raw token string absent from the log
• Log not emitted for other 401 causes (missing token, invalid signature)
• One log per request (not duplicated across middleware)

ETA: 12 hours

---

Coordinate on Telegram