Resolves teamhanko#2398

## Summary
Changed HTTP status code from 408 (Request Timeout) to 400 (Bad Request)
when a passcode has expired. This better aligns with HTTP semantics and
the actual error condition.

## Changes
- Changed status code from `http.StatusRequestTimeout` (408) to
  `http.StatusBadRequest` (400) in passcode.go
- Updated error message from "passcode request timed out" to
  "passcode has expired" for clarity
- Removed TODO comment as the issue has been resolved

## Rationale

HTTP 408 (Request Timeout) is meant for situations where:
- The client took too long to send the request
- The server timed out waiting for request data
- Network/connection issues caused timeouts

HTTP 400 (Bad Request) is appropriate when:
- Client sends invalid or expired data (like an expired passcode)
- Application-level validation fails
- Business logic determines request is malformed

## Impact
- Prevents HTTP clients from auto-retrying (which they often do for 408s)
- Improves monitoring accuracy (408s typically indicate infrastructure
  issues, not validation failures)
- Aligns with RFC 7231 HTTP status code semantics
- Better API ergonomics for API consumers

## References
- RFC 7231: https://tools.ietf.org/html/rfc7231#section-6.5.1