router cache-expiry test: migrate to fake timers

[y1o1]

Follow-up from PR #22 review (Copilot comment on `src/modes/injection/tests/router.test.mts:337`).

Context

The cache-expiry integration test currently uses `await new Promise((r) => setTimeout(r, 1100))` with `ttlSeconds: 1, safetyMarginSeconds: 0` to verify that the token cache correctly re-fetches after expiry.

Issue

Real timers introduce two costs:

1. Speed: 1.1s added to every test run.
2. Flakiness: under CI load, the 100ms slack past `ttlSeconds=1` could eat into runtime variance.

Why deferred

The test has been stable in local runs. Migrating to `vi.useFakeTimers()` + `vi.advanceTimersByTime()` is non-trivial in the current harness because the router uses `supertest` + real `http.createServer` upstream recorder — fake timers can fight with real HTTP/IO. A clean migration needs:

• Decide whether the upstream recorder and supertest interact correctly with fake timers.
• Or: refactor the test to assert directly on middleware-level behavior (without upstream proxy) so fake timers have no IO to fight.

Proposed fix

Either:

• (a) Introduce fake timers carefully, confirming supertest + http server interaction.
• (b) Refactor this specific test to a middleware-level unit test (drop supertest, exercise `injectionMiddleware` directly) — then fake timers are trivial.

Related

• PR feat(v0.5.0): add injection mode (OWASP Token Handler Pattern) #22 Copilot review comment (deferred)
• PR feat(v0.5.0): add injection mode (OWASP Token Handler Pattern) #22 final code review M2 (CI-flaky risk flagged)