fix(router-access): align expiry semantics and fix RoleMemberCount bookkeeping

[joshfatoye0011-bit]

Closes #716 ## Summary Three related bugs fixed in contracts/router-access/src/lib.rs. ### 1. Expiry comparison inconsistency (>= → >) is_role_expired and has_direct_role_internal both used >=, so a role whose expires_at equalled the current timestamp was already considered expired.
outer-core's is_route_expired uses >, making expires_at the last valid ledger sequence. Both sites changed to > to match that convention and document the choice. ### 2. RoleMemberCount never incremented on grant grant_role_internal had a comment saying it would maintain RoleMemberCount without iterating RoleMembers, but the increment was never written. Fixed by capturing currently_active before any writes, then incrementing only when !currently_active (new grant or re-grant after expiry). An expiry update on a live role does not increment to avoid double-counting. ### 3. Premature storage removal in expire_role caused count decrement to be skipped expire_role removed HasRole and RoleExpiry directly before delegating to deactivate_role_grant. Because deactivate_role_grant calls has_role_internal to decide whether to decrement the count, those early removes made it always see the role as inactive and skip the decrement. Removed the redundant removes so deactivate_role_grant is the single cleanup path for both expire_role and
evoke_role. ## Tests Added est_role_valid_at_exact_expiry_timestamp_expired_one_second_after to pin the new boundary semantics: role is valid when current == expires_at, expired only when current > expires_at. All 50 router-access tests pass.

[drips-wave]

@joshfatoye0011-bit Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits