Align MCP token creation reference time

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/bc3c4ad5-6f8e-47fe-a4e4-dd78459a3763

Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Author: Copilot

EssentialCSharp.Web.Tests/McpApiTokenServiceTests.cs

@@ -51,4 +51,24 @@ await Assert.That(() => tokenService.CreateTokenAsync(userId, "too-long", reques
             .Throws<ArgumentOutOfRangeException>()
             .WithMessageContaining(McpApiTokenService.MaxExpiryValidationMessage);
     }
+
+    [Test]
+    public async Task CreateTokenAsync_WithExplicitCreatedAt_UsesReferenceTimeForDefaultExpiry()
+    {
+        string userId = await McpTestHelper.CreateUserAsync(factory, "mcp-explicit-created-at");
+
+        using var scope = factory.Services.CreateScope();
+        var tokenService = scope.ServiceProvider.GetRequiredService<McpApiTokenService>();
+        DateTime createdAtUtc = new(2026, 4, 30, 23, 59, 59, DateTimeKind.Utc);
+
+        (_, var entity) = await tokenService.CreateTokenAsync(
+            userId,
+            "explicit-created-at",
+            createdAtUtc: createdAtUtc);
+
+        await Assert.That(entity.CreatedAt).IsEqualTo(createdAtUtc);
+        await Assert.That(entity.ExpiresAt).IsNotNull();
+        await Assert.That(entity.ExpiresAt!.Value)
+            .IsEqualTo(McpApiTokenService.GetDefaultExpirationUtc(createdAtUtc));
+    }
 }

EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/McpAccess.cshtml.cs

@@ -72,7 +72,11 @@ public async Task<IActionResult> OnPostCreateAsync()
         // Convert date-only boundary to end-of-day UTC instant before persisting
         DateTime? expiresAt = ExpiresOn?.ToDateTime(TimeOnly.MaxValue, DateTimeKind.Utc);
 
-        var (rawToken, entity) = await tokenService.CreateTokenAsync(userId, TokenName.Trim(), expiresAt);
+        var (rawToken, entity) = await tokenService.CreateTokenAsync(
+            userId,
+            TokenName.Trim(),
+            expiresAt,
+            createdAtUtc: nowUtc);
         GeneratedToken = rawToken;
         GeneratedTokenEntity = entity;
         UserTokens = await tokenService.GetUserTokensAsync(userId);

EssentialCSharp.Web/Controllers/McpTokenController.cs

@@ -41,7 +41,11 @@ public async Task<IActionResult> CreateToken(
         }
 
         var (rawToken, entity) = await tokenService.CreateTokenAsync(
-            userId, name, expiresAt, cancellationToken);
+            userId,
+            name,
+            expiresAt,
+            createdAtUtc: nowUtc,
+            cancellationToken: cancellationToken);
 
         return Ok(new
         {

EssentialCSharp.Web/Services/McpApiTokenService.cs

@@ -36,10 +36,11 @@ public static string GenerateRawToken()
         string userId,
         string name,
         DateTime? expiresAt = null,
+        DateTime? createdAtUtc = null,
         CancellationToken cancellationToken = default)
     {
         string raw = GenerateRawToken();
-        DateTime createdAt = DateTime.UtcNow;
+        DateTime createdAt = createdAtUtc ?? DateTime.UtcNow;
         DateTime effectiveExpiration = ResolveExpiration(expiresAt, createdAt);
 
         var entity = new McpApiToken