Closes #20823: Validate Token expiration date on creation

[pheus]

Fixes: #20823

This PR adds model-level validation to prevent creating API tokens with an expiration date in the past, while still allowing updates to existing tokens (including already-expired ones).

Changes:

• Updates Token.clean() to raise a ValidationError when creating a new token (pk is None) whose expires timestamp is already in the past.
• Leaves updates to existing tokens unchanged so that expired tokens can still be modified as needed.
• Adds tests in users/tests/test_models.py covering:
  • the Token.is_expired property for None, future, and past expiration times
  • creation of tokens with a past expiration date
  • updates to existing expired tokens

No database or API schema changes are introduced by this PR.

[pheus]

Thanks again for the detailed review and the pointers around timezones and i18n 🙏

I’ve updated the ValidationError to include both the current server time and the configured timezone, following the pattern from DateTimeColumn and using named placeholders so it’s translation‑friendly.

For local verification, I regenerated the English and German message catalogs and confirmed that the new string and the translators’ hint are picked up correctly. The entry looks like this in django.po:

#. Translators: {current_time} is the current server date and time in ISO format,
#. {timezone} is the configured server time zone (for example, "UTC" or "Europe/Berlin").
#: users/models/tokens.py:78
#, python-brace-format
msgid ""
"Expiration time must be in the future. Current server time is {current_time} "
"({timezone})."
msgstr "Das Ablaufdatum muss in der Zukunft liegen. Aktuelle Serverzeit ist {current_time} ({timezone})."