Refuse expired candidate offers at lookup time

Store each offer set's deadline and check it under offersMu in
candidateURL, so an expired candidate id cannot ground a dinner while its
eviction timer is delayed. The timer still evicts the set from memory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dinners/export_test.go

@@ -22,6 +22,15 @@ func SetOfferLifetime(t *testing.T, d time.Duration) {
 	t.Cleanup(func() { offerLifetime = old })
 }
 
+// AdvanceClock moves the service's clock d ahead of real time until t
+// ends, without firing any timer. A test calling it must not run in
+// parallel.
+func AdvanceClock(t *testing.T, d time.Duration) {
+	old := now
+	now = func() time.Time { return old().Add(d) }
+	t.Cleanup(func() { now = old })
+}
+
 // HasOffers reports whether the service holds candidates offered for
 // dinner id.
 func (s *Service) HasOffers(id string) bool {