server: Give clients a 5-second leeway in mailbox auth expiry

We seem to get a lot of logs of expired mailbox auth. There might be clients re-using their auth right until expiry and then get an error from us because a second passed.

Summary by CodeRabbit

• Bug Fixes
  • Improved mailbox authorization expiry handling by adding a 5-second grace period to avoid premature expiration.
• New Features
  • Updated mailbox request payloads and server handling to use mailbox_id consistently (including mailbox reads, subscriptions, and recovery VTXO posting).
• Tests
  • Updated mailbox-related tests to construct requests with mailbox_id instead of the previous identifier field across all affected flows.