E401 Unauthorized when publishing with expired limited token

Determine whether the npm CLI should automatically treat a token as invalid once its embedded expiry timestamp has passed, removing the need for manual revocation when adhering to least‑privilege authentication.

Current behaviour leaves expiry optional; legacy tokens lack an expiry field, registries may accept stale tokens indefinitely, and the CLI provides no built‑in check. This creates uncertainty about where enforcement should reside — client‑side, registry‑side, or user‑driven. Should the npm CLI reject a token after its expiry timestamp? Should it warn users when a token is nearing expiration? Is there a preferred mechanism for automatic token invalidation that aligns with least‑privilege guidance?