Add configurable consent expiration to require periodic re-authorization

[leodip]

Problem

Once a user grants consent to a client, that consent persists indefinitely in the database. There is no mechanism to automatically expire
old consents, which means:

• Users may forget which applications have access to their data
• Compromised or abandoned clients retain access indefinitely
• No opportunity for users to review permissions periodically

Current Behavior

// Consent stored with GrantedAt timestamp but no expiration check
type UserConsent struct {
UserId int64
ClientId int64
Scope string
GrantedAt sql.NullTime
}

Consent is reused indefinitely if all requested scopes were previously granted (handler_consent.go:115-137).

Proposed Solution

1. Add ConsentMaxLifetimeInSeconds setting (global and per-client override)
2. Modify consent check to compare GrantedAt + MaxLifetime against current time
3. When consent expires, user sees consent screen again (not an error)
4. Default could be 0 (no expiration) for backwards compatibility

Example implementation

// In consent checking logic
if consent.GrantedAt.Valid {
consentAge := time.Since(consent.GrantedAt.Time)
if settings.ConsentMaxLifetimeInSeconds > 0 &&
consentAge > time.Duration(settings.ConsentMaxLifetimeInSeconds)*time.Second {
// Treat as no consent - show consent screen
}
}

[leodip]

Configuration Options

• Global setting: Settings.ConsentMaxLifetimeInSeconds
• Per-client override: Client.ConsentMaxLifetimeInSeconds
• Suggested default: 0 (disabled) or 31536000 (1 year)