Fix SEC-12: reduce default token expiry to 7 days

- Change default_expiry from 720h (30 days) to 168h (7 days)
  in dist/mcias.conf.example and dist/mcias.conf.docker.example
- Update man page, ARCHITECTURE.md, and config.go comment
- Max ceiling validation remains at 30 days (unchanged)

Security: Shorter default token lifetime reduces the window of
exposure if a token is leaked. 7 days balances convenience and
security for a personal SSO. The 30-day max ceiling is preserved
so operators can still override if needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

man/man1/mciassrv.1

@@ -77,7 +77,7 @@ WAL mode and foreign key enforcement are enabled automatically.
 Issuer claim embedded in every JWT.
 Use the base URL of your MCIAS server.
 .It Sy default_expiry
-.Pq optional, default 720h
+.Pq optional, default 168h
 Token expiry for interactive logins.
 Go duration string.
 .It Sy admin_expiry