feat: relative-time timestamp annotations + nil stdin-stat guard

[bsg62]

Implements two improvements discussed together.

#3 — Relative-time annotations

The iat/exp/nbf display annotations now carry the time remaining or elapsed instead of a bare flag:

• exp in the future → expires in 14m
• exp in the past → expired 2h ago
• nbf in the future → not yet valid, in 5m
• nbf already valid → no note (the ordinary active state)

humanizeDuration renders the largest whole unit (s/m/h/d), truncating toward zero so output is deterministic and testable. The annotations stay display-only — verification and the exit code remain purely cryptographic, and the --json path is unchanged (raw numeric claims).

#5 — nil stdin-stat guard

readToken discarded the error from os.Stdin.Stat() and dereferenced the result. On a closed/detached stdin Stat() can return a nil FileInfo, panicking at stat.Mode(). It now falls through to the interactive prompt in that case.

Tests

• New TestHumanizeDuration (table-driven, incl. boundary rounding and negative magnitude) and TestFormatTimestamps_ExpiredShowsElapsed.
• Updated the existing formatTimestamps tests for the enriched exp/nbf wording; renamed NoAnnotationWhenCurrentlyValid → InsideValidityWindow and tightened it to assert the new "expires in" note and the bare already-valid nbf.

Follow-up (not in this PR)

site/index.html's hero example hardcodes (…, expired) and is paired with a generated og.png. A relative duration would drift on a static page and re-rendering the OG image is a separate concern, so the marketing site is intentionally left untouched here.

🤖 Generated with Claude Code