…ay TTL)

Adds token expiry to MCP connectors so bearer tokens no longer live forever.
Existing live tokens receive a 90-day grace via a non-destructive backfill
migration; new tokens always carry a computed expires_at from creation time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…disposable-DB guidance

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…alidation module

Root causes of the 3 failing tests:

1. `skips unselected media entries` and `full-site round-trip` (import-export-
   roundtrip.test.ts): both fixtures used fake ASCII bytes as PNG content
   (`strToU8('keep')`, `Buffer.from('fake-png-bytes')`). The new
   `validateAndSanitizeMediaBytesForImport` gate introduced on this branch
   calls `detectAcceptedMime()` on every staged entry before writing to disk;
   plain ASCII returns null → ArchiveMediaValidationError → 400.
   Fix: update both fixtures to use real PNG magic bytes (8-byte signature ±
   padding to keep `sizeBytes` consistent with DB records).

2. `Module size budgets`: `importArchive.ts` grew to 771 lines (ceiling 700)
   after the new validation class and function were added inline.
   Fix: extract `ArchiveMediaValidationError` and
   `validateAndSanitizeMediaBytesForImport` into the focused new module
   `server/handlers/cms/importArchiveMediaValidation.ts` (97 lines);
   `importArchive.ts` drops to 688 lines. Add the new helper to the
   cms-handlers-capability-gated ALLOWLIST (it's not a route handler,
   same pattern as mediaUpload.ts / svgSanitize.ts).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Migration 019 now only adds the expires_at column (no backfill UPDATE).
Pre-existing / grandfathered rows have NULL expires_at, which the SQL
predicate `(expires_at is null or expires_at > now)` already accepts as
valid — no extra code needed. rowToRecord passes NULL through as-is
(string | null) instead of coercing it to epoch-0. McpConnectorViewSchema
and McpConnectorRecord updated to string | null. New tests assert that a
connector with NULL expires_at is accepted by both findConnectorByTokenHash
and resolveMcpAuth.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add an "Expires after" Select field (30 days / 90 days / 1 year, default 90)
to the Add MCP Connector dialog. The selected value is converted to an integer
and sent as `ttlDays` in the create request. The connector list now also renders
`expiresAt` — formatted as a local date when set, or "No expiry" when null.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…s:null

Add `null` as an explicit opt-in value for `ttlDays` when creating an MCP
connector, meaning the token never expires. A number still produces a
concrete expiry; omitting the field defaults to 90 days. The `expires_at`
column is already nullable and `findConnectorByTokenHash` already treats
NULL as non-expiring, so this is a pure schema/logic change with no
migration required.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Adds a 'No expiry' choice to the TTL selector in the Add Connector
dialog. Selecting it sends `ttlDays: null` to the backend, which the
server now accepts as an explicit opt-in for a non-expiring token.
Default selection remains 90 days.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>