s2s/xline: reject a malformed ADDLINE duration instead of coercing it to 0 (= a silent permanent ban), and make add_xline expiry saturating (n.saturating_add) so a peer sending duration=u64::MAX can't overflow-panic the debug build or wrap in release

src/link.rs

@@ -1361,7 +1361,12 @@ impl Server {
         let Some(kind) = crate::xline::XKind::from_tag(&msg.params[0]) else {
             return;
         };
-        let duration: u64 = msg.params[4].parse().unwrap_or(0);
+        // A malformed duration must not be silently coerced to 0 (= permanent);
+        // a legitimate peer always sends a decimal integer (0 explicitly means
+        // permanent). Reject garbage rather than installing an accidental perma-ban.
+        let Ok(duration) = msg.params[4].parse::<u64>() else {
+            return;
+        };
         self.add_xline(kind, &msg.params[1], duration, &msg.params[2], &msg.params[5]);
         self.propagate(&msg.to_wire(), Some(via));
     }

src/xline.rs

@@ -259,7 +259,7 @@ impl Server {
             mask: mask.to_string(),
             reason: reason.to_string(),
             setter: setter.to_string(),
-            expires: if duration == 0 { 0 } else { n + duration },
+            expires: if duration == 0 { 0 } else { n.saturating_add(duration) },
         });
         self.snotice_c('x', &format!(
             "{setter} added a {}-line on {mask}: {reason}",