fix(cli): campus.audit key status should distinguish expired from active #56

Context

The campus audit command group landed in #55. Its key listing renders a
status label, and the first cut derived it from the presence of
expires_at alone:

status = "[green]active[/green]"
if record.get("revoked_at"):
    status = "[red]revoked[/red]"
elif record.get("expires_at"):
    status = "[yellow]expires[/yellow]"

So a key that is still perfectly usable but happens to have an expiry date
in the future renders as Status: expires, and a key that expired six
months ago renders exactly the same way. The operator cannot tell a live
key from a dead one without reading the date on the detail line.

The server already draws the line correctly (APIKey.is_active() is "not
expired and not revoked"); the CLI just does not make the same distinction.

Proposed fix

Compare expires_at against the current time and report three states:

• revoked — revoked_at is set (red)
• expired — expires_at is in the past (red)
• active — otherwise (green), with the expiry date still shown on the
  detail line

A key with no expiry stays active. An unparsable expires_at must not
count as expired (unknown is not expired).

Acceptance

• A key with a future expires_at renders Status: active.
• A key with a past expires_at renders Status: expired.
• A revoked key renders Status: revoked (revocation wins over expiry).
• A key with no expiry renders Status: active.
• An unparsable expires_at renders Status: active.