fix: sync temp auth key expiry boundaries

internal/mtprotoedge/exchange.go

@@ -98,12 +98,13 @@ func (s *Server) handleExchange(ctx context.Context, conn transport.Conn, first
 }
 
 // authKeyData 把握手结果转换为 store 记录。
-func authKeyData(key crypto.AuthKey, salt, createdAt int64) store.AuthKeyData {
+func authKeyData(key crypto.AuthKey, salt, createdAt int64, expiresAt int) store.AuthKeyData {
 	return store.AuthKeyData{
 		ID:         key.ID,
 		Value:      [256]byte(key.Value),
 		ServerSalt: salt,
 		CreatedAt:  createdAt,
+		ExpiresAt:  expiresAt,
 	}
 }
 
@@ -120,6 +121,24 @@ func (s *Server) sendProtoError(ctx context.Context, conn transport.Conn, code i
 	return nil
 }
 
+// sendTerminalProtoError serializes a bare transport error after the authenticated
+// outbound actor has stopped. A direct write while the actor is still draining can
+// otherwise interleave an encrypted update/result after -404 on the same socket.
+func (s *Server) sendTerminalProtoError(ctx context.Context, c *Conn, code int32) error {
+	if c == nil {
+		return errors.New("send terminal protocol error without logical connection")
+	}
+	c.beginTerminalShutdown()
+	if !c.waitOutboundShutdownUntil(forceCloseBatchTimeout) {
+		c.closeTransport()
+		return errors.New("outbound writer did not stop before terminal protocol error")
+	}
+	if c.transport == nil {
+		return ErrConnClosed
+	}
+	return s.sendProtoError(ctx, c.transport, code)
+}
+
 // maxHandshakeReqPQ 是一次密钥交换内允许的 req_pq(_multi) 帧数上界。正常握手只发 1 个
 // req_pq（含个别客户端的「fake+真」也就 2 个）；客户端因 nonce 失步陷入「收到 ResPQ→立刻
 // 重启握手换 nonce 重发 req_pq」死循环时，会在同一连接上无限发 req_pq，而委托给 gotd 的