server: refuse expired vtxos as arkoor inputs

• check or remove this line after you've added a CHANGELOG entry or if your PR doesn't need one (they should go into CHANGELOG/unreleased/)