accessTokenIfNotExpired
Returns the access token string if it has not expired, or null if it has.
This is a pure read with no side effects — it checks the token's issuedAt + expiresIn against the current clock and never triggers a network call. Use refreshIfExpired when you need a guaranteed-valid token.
Return
the access token string, or null if the token has expired.