feat: Various typing improvements

[khvn26]

• Resorted to using virtual subclassing instead of a current TypeVar for the AuthToken/AbstractBaseUser covariant type as it doesn't seem to play nice with Mypy.
• Added virtual subclassing to the mixin. Current Generic usage seems plain wrong.
• Added if TYPE_CHECKING: assert self.user assertions to TokenObtainSerializer implementations to make Mypy understand the serializer lifecycle.
• Added type-checking assertion for lifetime in Token.set_exp.
• Other minor improvements.

[vgrozdanic]

Thank you for your contribution!

I see that a lot of tests are failing, python 3.9 which we still support doesn't have some of the typing attributes available (e.g. TypeAlias).

Can you please make this PR compatible with python versions 3.9 - 3.13?

[vgrozdanic]

why is this being introduced?

Is there a reason why TokenUser should be a subclass of AbstractBaseUser?

[Andrew-Chen-Wang]

I have a feeling it's because, unlike Typescript, there isn't interface overlapping in Python, so the author was trying to resolve what happens when you receive a "user" type.

They made a change here that explains it a little:

Suggested change

	class TokenUser(TokenUserBase):
	- AuthUser = TypeVar("AuthUser", AbstractBaseUser, TokenUser)
	+ TokenTypeVar = TypeVar("TokenTypeVar", bound=Token)