Warn before the client secret expires (SP_SECRET_EXPIRES)

Azure client secrets lapse silently into opaque 401s (AADSTS7000222). Add a self-reported expiry date (SP_SECRET_EXPIRES=YYYY-MM-DD) and a shared secretExpiryStatus() helper in graph.mjs; surface warnings <30 days out via the CLI (stderr on every command + test output), MCP server startup log, /health, and the sharepoint_test tool. Documented in both .env.examples, setup.md, and READMEs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/sharepoint-lists/scripts/sp.mjs

@@ -25,7 +25,7 @@
 import { readFileSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { SharePointListsClient, GraphError } from "./lib/graph.mjs";
+import { SharePointListsClient, GraphError, secretExpiryStatus } from "./lib/graph.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -57,6 +57,11 @@ async function main() {
     clientSecret: env("SP_CLIENT_SECRET", "AZURE_CLIENT_SECRET"),
   });
 
+  // Nag (on stderr, so stdout stays clean JSON) when the client secret is
+  // close to its self-reported expiry — see secretExpiryStatus in graph.mjs.
+  const expiry = secretExpiryStatus(process.env.SP_SECRET_EXPIRES);
+  if (expiry?.message) process.stderr.write(`⚠ ${expiry.message}\n`);
+
   const site = flags.site || process.env.SP_SITE_URL;
   const needSite = () => {
     if (!site) throw new Error("Missing --site URL (or set SP_SITE_URL).");
@@ -75,6 +80,7 @@ async function main() {
   switch (command) {
     case "test":
       result = await client.test(site);
+      if (expiry) result.secretExpiry = expiry;
       break;
     case "lists":
       result = await client.listLists(await needSite());