What

Fix a one-character typo in the claims struct in internal/server/authn/method/kubernetes/server.go.

The Expiration field has the struct tag jsom:"exp" instead of json:"exp".

-	Expiration int64    `jsom:"exp"`
+	Expiration int64    `json:"exp"`

Why

This typo causes Go's encoding/json package to never unmarshal the exp field from the Kubernetes service account JWT. As a result:

• claims.Expiration is always 0
• time.Unix(0, 0) (January 1, 1970) is used as the token expiry
• Any downstream check comparing expiry to time.Now() will treat the token as immediately expired
• This breaks Kubernetes service account authentication for consumers relying on token lifetime

We discovered this while building Flipt from source and had to patch it with sed in our Dockerfile as a workaround. This PR fixes it properly upstream.

Testing

Existing unit tests should continue to pass. K8s auth integration tests may now behave differently — tokens will correctly reflect their actual expiry instead of always being epoch 0.