Class SessionTokenTracker

Record that a token was issued at now (defaults to Date.now()).

Forget the issuance window — call on deleteSession / 401-driven invalidation.

Visible for diagnostics.

Decide whether the session for profileId should be refreshed before the next authenticated request.

Behavior:

• refreshLeadMs <= 0 disables proactive refresh entirely (rely on 401-retry).
• Unknown profile (no recorded issuance) returns false — the persisted token is trusted; 401-retry will catch real expiry. This prevents orphaning sessions on every extension restart.
• Negative ageMs (clock skew) is clamped to 0 so a backwards clock jump doesn't extend the perceived lifetime.
• If refreshLeadMs >= maxAgeMs, lifetime is clamped to maxAgeMs to avoid an infinite refresh loop where every check thinks a refresh is overdue.