Platform /auth/verify expiresIn coerced unsafely — non-numeric or string value yields NaN expiresAt

Opus finding

Platform /auth/verify expiresIn coerced unsafely — non-numeric or string value yields NaN expiresAt

• src/api/platform.ts:102-116

data.expiresIn is typed unknown and cast with `as number` without runtime validation. If the platform returns expiresIn as a string (e.g. "86400") or anything non-numeric, `now + expiresInSec * 1000` becomes NaN. expiresAt: NaN then survives into the session cache; the getOrRefreshSession check `Date.now() + REFRESH_MARGIN_MS < cached.expiresAt` is false for NaN, so it'd refresh on every call — but the emitted ISO/remainingSeconds in auth.ts would show Invalid Date / negative numbers (Math.max guards remainingSec, but new Date(NaN).toISOString() throws RangeError, crashing the auth command after a successful sign-in).