harden server — startup, shutdown, overflow guards

[kacy]

summary

two rounds of full codebase audits surfaced 9 hardening issues across 12 files. this PR fixes all of them:

round 1 — server lifecycle & arithmetic

• replace .expect() on address parsing with graceful eprintln + exit(1) (main.rs, 3 sites)
• clamp Duration::as_millis() u128→i64 cast to i64::MAX in shard TTL fields (shard.rs, 3 sites)
• add 30s shutdown timeout so hung connections don't block exit (server.rs)
• fix gossip port arithmetic: checked_add at startup, saturating_add in internal paths, fix hardcoded 10000 in cluster_meet to use configured gossip_port_offset (main.rs, cluster.rs, topology.rs)
• add truncated snapshot test (snapshot.rs)

round 2 — protocol, persistence, core, cluster

• add MAX_NESTING_DEPTH (64) to RESP3 parser to prevent stack overflow from deeply nested arrays/maps (parse.rs, error.rs)
• clamp recovery TTL arithmetic: (seconds * 1000) as i64 → saturating_mul + min(i64::MAX), and milliseconds as i64 → min(i64::MAX) (recovery.rs)
• replace DropHandle::spawn() .expect() with graceful degradation — logs warning and falls back to inline dropping via existing try_send Disconnected handling (dropper.rs)
• add SlotRange::try_new() with runtime validation, use it in gossip decode path where slot data comes from the network (slots.rs, message.rs)

what was tested

• full test suite: 471 tests across all 5 crates — all passing
• cargo clippy --workspace -- -D warnings — clean
• cargo fmt --all — clean

design considerations

• parser depth limit of 64 matches redis's practical nesting limit and is well within default stack size
• drop thread failure degrades to inline dropping with zero caller changes — the existing try_send / TrySendError::Disconnected paths handle it naturally
• SlotRange::try_new() is separate from new() so internal callers with known-valid ranges don't pay for error handling