Function temporal_sanity 

fn temporal_sanity(record: &SupporterRecord, now: DateTime<Utc>) -> bool

Reject records whose timestamps are impossible — e.g. activated_at later than last_validated_at, or either timestamp far enough into the future to suggest the user wound their clock forward to extend the offline grace window. NTP drift is accommodated by FUTURE_CLOCK_SKEW_TOLERANCE.