Class FMClient

Visible for testing. Returns true if the in-memory issuance window indicates the token needs refresh.

Behavior:

• If refreshLeadMs is 0, proactive timed refresh is disabled (rely on 401-retry only).
• If issuedAt is unknown (e.g., extension restart), reuse the persisted token instead of forcing refresh — the 401-retry path handles real expiry.
• Clock skew (negative ageMs) is treated as 0 to prevent extending lifetime via clock jumps.
• If refreshLeadMs >= maxAgeMs, lifetime is clamped to maxAgeMs to avoid infinite refresh loops.