fix(api): 修复 API Token 过期校验与更新校验

- 将数据库中的 expires_at 设为必填，并在认证时仅允许未过期的令牌通过
- 增加空过期时间的更新校验，避免写入非法时间值
- 补充过期令牌与空过期时间更新的测试覆盖
- 调整前端日期输入与提交逻辑，避免创建 API Token 时表单异常中断

apps/api/internal/app/app_test.go

@@ -1705,6 +1705,15 @@ func TestAPITokenManagementStoresHashAndRevokes(t *testing.T) {
 	if code := openAdmin.do("GET", "/api/open/domains", nil, &domains); code != http.StatusOK {
 		t.Fatalf("open api with bearer token code=%d", code)
 	}
+	if _, err := a.db.Exec(`UPDATE api_tokens SET expires_at=? WHERE id=?`, a.now().UTC().Add(-time.Minute).Format(time.RFC3339Nano), created.Item.ID); err != nil {
+		t.Fatal(err)
+	}
+	if code := openAdmin.do("GET", "/api/open/domains", nil, &map[string]any{}); code != http.StatusUnauthorized {
+		t.Fatalf("expired bearer token code=%d", code)
+	}
+	if _, err := a.db.Exec(`UPDATE api_tokens SET expires_at=? WHERE id=?`, created.Item.ExpiresAt.UTC().Format(time.RFC3339Nano), created.Item.ID); err != nil {
+		t.Fatal(err)
+	}
 	var listed struct {
 		Items []APIToken `json:"items"`
 	}
@@ -1715,6 +1724,10 @@ func TestAPITokenManagementStoresHashAndRevokes(t *testing.T) {
 		t.Fatalf("listed tokens=%+v", listed.Items)
 	}
 
+	if code := admin.do("POST", "/api/me/api-tokens/"+created.Item.ID, map[string]any{"expiresAt": ""}, &map[string]any{}); code != http.StatusBadRequest {
+		t.Fatalf("empty api token expiry update code=%d", code)
+	}
+
 	disabled := true
 	var updated APIToken
 	if code := admin.do("POST", "/api/me/api-tokens/"+created.Item.ID, map[string]any{"disabled": disabled}, &updated); code != http.StatusOK {