mrhid6
225b53bfa7
Every request presenting an expired token wrote a token.expired_use audit row, and RateLimitTokens only applies once a session exists, so a rejected token was never rate-limited. A looping job with one expired token could write an unbounded number of audit rows, drowning the real audit trail. services.ShouldLogExpiredTokenUse now dedupes to at most one token.expired_use record per token per minute, mirroring the throttle TouchAPIToken already uses for last-used. It lives in services rather than auth because the storage concern belongs beside the token's other storage-backed state. The first use per window is still recorded, which is what makes a forgotten job visible.