fix: use standard JWT expiry claims for image proxy

[vlnst]

ImageProxyClaims declared its own iss/exp fields with the same JSON names as the standard ones in the embedded jwt.RegisteredClaims, so the standard fields stayed empty and the jwt library skipped the expiry check; only a manual check in routes/image.go did it.

This switches to the standard IssuedAt/ExpiresAt, lets ParseWithClaims enforce expiry, removes the manual check, and adds a test.

The test uses jwt.TimeFunc, which jwt v5 removed. If #198 is merged first, it needs jwt.WithTimeFunc instead.