KemalIdentity::Clock

The only source of "now" in the shard.

Every expiry, freshness and throttling decision reads the clock through this contract, which is what makes those decisions testable: a spec that asserts a session expires after twelve hours advances a TestClock instead of sleeping or stubbing the system clock. src/CLAUDE.md bans Time.utc everywhere in src/ except SystemClock below; spec/unit/source_hygiene_spec.cr enforces that ban.