Epoch seconds after which the gateway refuses the token. Always set — this one leaves the
machine, and unlike the ConnectToken it authorizes a dial target rather than a session, so it is
minted short-lived.
The ikon server's hostname, as the gateway will dial and TLS-validate it. A fleet instance
presents the platform wildcard certificate, so this must be the real FQDN and never an address.
Both upstream ports, because the two legs land on different ones: /connect is HTTPS to HttpsPort,
and the channel is a raw TCP socket to TlsPort. HostAgent allocates them separately from one
range, so neither can be derived from the other.