feat(#3636710): let a registered target set its own expiry, and remove it

A registered preview target can set its own expiry with expires_in on a PATCH, capped at the Delete after setting. Once that time comes, the target leaves the Frontend picker, a preview doesn't get a token for it, and cron deletes it. A frontend that stops can remove its target by label with a DELETE on the targets endpoint. For a 1.0.0-beta1 site, an update adds the expires column and keeps its stored targets.