harden server — startup, shutdown, overflow guards

[kacy]

summary

• replace three .expect() calls on address parsing in main.rs with graceful eprintln! + exit(1), matching the pattern used everywhere else in the file
• clamp Duration::as_millis() (u128) to i64::MAX before casting to i64 in AOF expire_ms fields — prevents silent sign corruption on extremely large TTLs
• add 30-second shutdown timeout so hung connections can't block server exit indefinitely
• fix gossip port arithmetic: checked_add validation at startup, saturating_add for internal paths, and fix cluster_meet which hardcoded 10000 instead of using the configured --cluster-port-offset
• add truncated snapshot test covering partial-read detection

what was tested

• cargo test -p emberkv-core -p ember-persistence -p ember-server -p ember-cluster — 467 tests pass
• cargo clippy --workspace -- -D warnings — clean

design considerations

• the cluster_meet hardcoded port offset was a real bug: if a user ran with --cluster-port-offset 20000, MEET commands would try to connect on the wrong gossip port. now uses self.gossip_port_offset with checked_add and returns an error frame on overflow.
• saturating_add is used for startup paths (already validated in main.rs) rather than checked_add to keep the code simple where overflow is already ruled out.
• shutdown timeout of 30s matches common defaults (nginx, haproxy). connections that don't drain in time get a warning log before the process exits.