In simple auth mode (no --idp), pod creation returns a JWT that expires after 1 hour. There is no way to get a new token without creating another pod, so expiry effectively locks you out.

With --idp enabled, 1 hour makes sense because you can log in again. Without it, there's no refresh path.

Suggestion: remove expiry (or make it very long) when not using --idp. The threat model for simple mode is already a dev/personal server — a leaked token requires a server secret rotation regardless of expiry.