Warn before eligible assignments expire and when eligibility is removed

[FrodeHus]

The problem

Elevate warns before an activation expires, but says nothing when an eligible assignment is about to end or has silently disappeared. Eligibility has end dates too (PIM defaults to one year for Entra roles, and Azure eligibility can be time-bound), and access packages that deliver eligible roles expire with the package. Losing eligibility is worse than losing an activation: the role vanishes from the panel and the person only finds out when they need it, usually during an incident.

What you would like Elevate to do

• Read the end date of each eligible assignment (Entra roles, Azure roles, PIM for Groups) and show it in the role's detail or tooltip, e.g. "Eligible until 12 Oct 2026".
• Notify at a configurable lead time (default 14 days, again at 3 days) before eligibility ends, per role and tenant, with the tenant's renewal path: a "Request extension" action where PIM allows self-service renewal, otherwise a hint naming the assignment so the person can ask an admin.
• Notify once when an eligible role that was present at the last refresh is gone ("Lost eligibility: Contributor on Prod in Contoso"). The new-role tracker already diffs the eligible set per tenant; this is the removal side of that diff.
• CLI: include eligibleUntil in elevate roles --json and a --expiring-within 30d filter, so scripts can report on it.

Area

Panel and notifications

Alternatives you considered

• Rely on the emails PIM sends to the assignee before expiry. They exist for Entra roles but are easy to lose in mail, and there is nothing comparable for a removed assignment.
• Only show the end date without notifications. Simpler, but it does not solve the "found out during an incident" case.

Anything else

• Entra roles: roleEligibilityScheduleInstances carry endDateTime; Azure: roleEligibilityScheduleInstances under ARM likewise; groups: privilegedAccess/group/eligibilityScheduleInstances. Self-service renewal is a selfRenew/adminExtend request on the schedule, which the existing extend flow for activations already resembles.
• Related: the new-role marker introduced with access packages (docs/access-packages.md, "New roles in the panel").