fix(W2/W3): expiry boundary — use <= today (expiry on today counts as expired)

Root cause: expires_at == today was NOT filtered (used '< today'), so a
product expiring ON today kept its resources in desired scopes -> no diff
-> no removal. Changed to '<='. Applied to W3 (CP + grant loops) and W2
(active filter). Also W2 previously had NO expiry filter on active CPs at
all.

n8n/W3-DESIGN.md

@@ -16,7 +16,7 @@
 
 1. 读该 customer 全部 CustomerProducts（`where=(customer.Id,eq,${cid})&limit=1000`）。
 2. desired paths = 仅取 **status=active 且未过期** 的 CP 的 Product→Resources `alist_path` 集合并。
-   - 过期判定：`status==='expired'` 或 `expires_at < today`，一律**排除**。
+   - 过期判定：`status==='expired'` 或 `expires_at <= today`，一律**排除**（含当天到期）。
    - 有效 CP 无 `expires_at` → 视为长期有效，保留。
 3. 读 AList role 当前 scopes（`role/get?id=`）。
 4. `desired paths` vs `current paths` → 差异即要改。