Use OAuthAuthorizationServerOptions.SystemClock and favor AuthenticationProperties.ExpiresUtc when present