@spec expunge_expired(
  Ash.Resource.t(),
  keyword()
) :: :ok | {:error, any()}

Bulk-destroy CIMD client rows (those with a cimd_url) whose last_used_at is older than the configured cimd_client_ttl.

Options

• :tenant — required for resources using strategy :context multitenancy without global? true. Defaults to nil.
• :domain — overrides the resource's compile-time domain.

@spec touch_last_used(
  Ash.Resource.record(),
  keyword()
) :: :ok

Refresh last_used_at on a single client record so an actively-used CIMD client is not collected. Best-effort: failures are logged, never raised, so a bookkeeping write can never fail a token exchange.