Supabase: Personal Access Tokens Get Expiry + Usage Tracking

Supabase personal access tokens now support expiration dates and usage tracking.

What changed: when creating a PAT you can set expiry with a preset duration, a custom date up to one year out, or never. Token usage is now tracked and refreshed every 15 minutes, so unused tokens are visible before they become a liability. It's general availability; self-hosted deployments aren't affected.

Why a builder cares: long-lived, never-rotated tokens are a classic credential leak — stale keys sitting in CI, scripts, and forgotten dashboards. Expiry at creation plus visibility into dead tokens turns "we should audit those someday" into a two-minute cleanup.