feat: what's expiring, in the status pane and lazysecrets expiring

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/app_test.go

@@ -1236,3 +1236,25 @@ func TestStatusPane(t *testing.T) {
 		t.Errorf("back to %v", d.m.focus)
 	}
 }
+
+func TestExpiringInStatus(t *testing.T) {
+	t.Parallel()
+	d := newDriverOpts(t, Options{ExpiryWarning: 30 * 24 * time.Hour}, fake.Azure(0))
+	d.keys("3", "]", "]") // load kv-app-prod's certificates
+	if !strings.Contains(d.screen(), "⚠ 1 expiring") {
+		t.Errorf("status line:\n%s", d.screen())
+	}
+	d.keys("0")
+	scr := d.screen()
+	for _, want := range []string{"expiring   ✗ expired  old-tls · kv-app-prod", "in 1 of 3 vaults (ctrl+a in search loads all)"} {
+		if !strings.Contains(scr, want) {
+			t.Errorf("missing %q:\n%s", want, scr)
+		}
+	}
+	d.keys("3", "[", "[", "0", "enter") // elsewhere, then to it from the status pane
+	d.m.fields.SelectWhere(func(f panes.Field) bool { return f.Label == "expiring" })
+	d.keys("enter")
+	if _, v, o := d.selected(); v != "kv-app-prod" || o != "old-tls" {
+		t.Errorf("enter went to %s/%s\n%s", v, o, d.screen())
+	}
+}