Function cache_ttl_for_token 

fn cache_ttl_for_token(
    expires_at: DateTime<Utc>,
    now: DateTime<Utc>,
) -> Duration

min(MAX_CACHE_TTL, expires_at - now), floored at zero — a flat TTL could otherwise outlive a short-lived token.