Function expiry_from 

pub fn expiry_from(created_at: SystemTime, ttl: Duration) -> SystemTime

Compute when a record originally captured at created_at will expire. Pulled out for unit-test reach; the SystemTime arithmetic is otherwise awkward to assert against without a clock injection point.