security: harden ember-protocol input validation - #131

summary

• parse_f64 now rejects inf/-inf in addition to NaN, making it consistent with parse_incrbyfloat which already had this check. prevents infinite scores in sorted sets.
• parse_slot_list and parse_cluster_setslot now validate that slot numbers are in the valid 0-16383 range. previously, any u16 value was accepted.
• parse_vadd/parse_vsim check MAX_VECTOR_DIMS inside the parsing loop instead of after full allocation, preventing unnecessary memory usage from oversized vectors.

what was tested

• cargo test -p ember-protocol — all 319 tests pass
• verified existing infinity-rejection test in parse_incrbyfloat still works
• confirmed slot validation catches values >= 16384

design considerations

• the infinity rejection in parse_f64 matches redis behavior (redis rejects inf as a ZADD score)
• slot validation uses 16384 constant directly rather than importing from ember-cluster to avoid a circular dependency
• vector dim check is now fail-fast: stops parsing immediately at the limit rather than allocating then checking