feat: support permanent credentials and overlapping token rotation

cmd/orbit-admin/main.go

@@ -257,6 +257,7 @@ func runBootstrap(args []string) error {
 	var in mysql.BootstrapInput
 	var output string
 	flags.StringVar(&in.Application, "application", "", "new application name")
+	flags.DurationVar(&in.ValidFor, "valid-for", 0, "initial credential validity: 0 permanent, or 1h to 8760h")
 	flags.Func("application-id", "existing application id; mutually exclusive with --application", func(v string) error {
 		in.ExistingApplicationID = core.ID(v)
 		return in.ExistingApplicationID.Validate()