Challenge expiration by jurisdiction (Indonesia 24h)

We've clarified how consent challenges expire, including a jurisdiction-specific window that was not documented before.

What's changed

Default expiration is unchanged: challenge URLs are valid for 2 weeks in live mode and 7 minutes in test mode.
Indonesia is 24 hours: parental-consent challenges (the initial verifiable parental consent request, including bulk or multi-product approval) expire 24 hours after creation, as required by local regulation. This deadline caps the challenge itself, not just the access link.
Past the deadline, refreshing does not help: once a challenge has expired, /challenge/generate-otp still mints a fresh one-time password and /challenge/get and /challenge/send-email still return a URL or send a link, but none of them can complete a past-deadline challenge: the trusted adult lands on "The request has expired." Create a new challenge to start a fresh consent request.