fix: reject expired link sessions

[NeerajCodz]

Motivation

• Prevent expired link sessions from being accepted after Redis TTL expiry because getLinkSession() could return DB rows whose expiresAt is in the past, allowing stale approved sessions to restart relays or authenticate relay sockets.
• Enforce a single expiry boundary and ensure relays require an explicitly approved, unexpired session.

Description

• Add isExpired() helper and enforce expiry in convex/linkSessions.ts so the get query returns null for expired sessions and updateStatus/updateTransport mutations reject expired sessions.
• Harden relay WebSocket authentication in apis/link/src/relay.ts to reject sessions whose status is not "approved" before registering participants.
• Add a unit test in convex/linkSessions.test.ts asserting that expired (previously approved) sessions are not returned by the get query.

Testing

• Added a unit test convex/linkSessions.test.ts::does not return expired sessions but running bunx vitest run convex/linkSessions.test.ts in this environment failed due to dependency resolution against the npm registry (HTTP 403), so the test could not be executed here.

---

Codex Task