What kind of change does this PR introduce?

This is a feature implementation

Add issued_at and expires_at to the bearer token response body, and teach the client-side OAuth2Token to prefer the server-provided issued_at over the local clock when computing expiration.

Server side (BearerTokenGenerator.generate())

• Captures a single time.time() call and resolves expires_in before calling access_token_generator(), storing both as self._issued_at and self._expires_in
• issued_at and expires_at are included in the response whenever expires_in is present
• For JWT tokens, JWTBearerTokenGenerator.access_token_generator() reads self._issued_at and self._expires_in directly, guaranteeing iat == issued_at and exp == expires_at — no duplicate time.time() or _get_expires_in() calls

Client side (OAuth2Token)

• When the server provides issued_at, the client computes expires_at from it instead of from the local clock, avoiding clock-skew issues
• Invalid issued_at values (zero, negative, non-numeric) fall back to the client clock gracefully
• Falls back to time.time() when issued_at is absent (backward compatible)

Persistence (save_token helpers)

• The default save_token helpers in both the SQLAlchemy and Django integrations now filter the token dict to known model columns before persisting, so new response-only fields do not break existing schemas

Checklist

• The commits follow the conventional commits specification.
• You ran the linters with prek.
• You wrote unit test to demonstrate the bug you are fixing, or to stress the feature you are bringing.
• You reached 100% of code coverage on the code you edited, without abusive use of pragma: no cover
• If this PR is about a new feature, or a behavior change, you have updated the documentation accordingly.

• You consent that the copyright of your pull request source code belongs to Authlib's author.