Switch task disablement to the aggregator's new deactivate_at method

[jcjones]

In divviup/janus@aacea12, part of divviup/janus#4684, we're preparing the task's validity interval (task_start + task_duration) to become part of the HPKE-AAD TaskConfiguration. Once that lands, the interval must be immutable -- mutating it would change the AAD and break already-uploaded reports.

As a result, the aggregator's PATCH /tasks/{task_id} endpoint will change:

• The old task_end field (which recomputed the validity interval's duration) goes away.
• It's replaced by deactivate_at, an Janus-specific field that is not part of the TaskConfiguration/AAD, so it can be changed freely at any time.
• Once the aggregator's clock reaches deactivate_at, the task stops accepting report uploads (and helper aggregation), which is the "disable/expire this task" behavior.
• deactivate_at is an ISO 8601 timestamp (e.g. "2026-07-01T00:00:00Z").

We need to:

• Update the aggregator client's task-patch request to send deactivate_at instead of task_end.
• Map the control-plane "disable/expire task" action onto deactivate_at rather than task_expiration. Since both aggregators are provisioned from a single ProvisionableTask, send the same value to leader and helper.
• Confirm nothing else relies on PATCHing the task's validity interval: that interval is now fixed at creation and no longer mutable!

[jcjones]

Note there will need to be a descriptor change in the UI: divviup/janus#4684 (comment)

[tgeoghegan]

And since divviup-api has to manage multiple Janus versions at once, including ones that represent tasks the old way, all this will be gated on the protocol key advertised by each aggregator.