fix(W2/W3): expiry boundary — use <= today (expiry on today counts as expired)

Root cause: expires_at == today was NOT filtered (used '< today'), so a
product expiring ON today kept its resources in desired scopes -> no diff
-> no removal. Changed to '<='. Applied to W3 (CP + grant loops) and W2
(active filter). Also W2 previously had NO expiry filter on active CPs at
all.

n8n/w2-compute.js

@@ -44,10 +44,12 @@ if (!customerId) {
   return { json: { skipWriteBack: true, customerProductId: custProdId, reason: 'no customer link yet' } };
 }
 
-// 2. load all active CPs for this customer
+// 2. load all active (and not-yet-expired) CPs for this customer
+const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'
 const cps = await ncGet(`/api/v2/tables/${T_CUSTPROD}/records?where=(customer,eq,${customerId})&limit=1000`);
 const active = (cps.list || []).filter(r => {
   if (r.status && r.status !== 'active') return false;
+  if (r.expires_at && String(r.expires_at) <= today) return false; // expired (incl. today)
   return true;
 });