JWT time claims validation

Validate the time-based claims of an already-decoded JWT payload (signature verification is out of scope). Given the claims dict and the current Unix time 'now', return 'valid' only if all present time claims pass: 'exp' (expiry) must be strictly greater than now, 'nbf' (not-before) must be <= now, and 'iat' (issued-at) must be <= now. A 'leeway' in seconds is allowed in the candidate's favor on each bound. Missing claims are skipped. Return the first failure as 'expired', 'not_yet_valid', or 'issued_in_future' in that check order, else 'valid'.