fix: reject overflowing backup and PostgreSQL durations

[vishr]

What this changes

Reject duration overflow before multiplying whole-day backup windows or PostgreSQL settings into nanoseconds. Previously 213504d became a plausible 25-minute window; oversized PostgreSQL values also wrapped in every supported unit. Backup health checks now report invalid or overflowing server timeouts and effective policies, and disabled archive timeouts, instead of silently treating them as within policy.

Addresses item 1 of #111. The other timing, documentation, and rollout follow-ups in that umbrella remain open.

Why this is correct

Regression tests failed on the original code and now cover the largest representable count and the first overflowing count for every PostgreSQL unit, positive day windows, and backup-policy validation for data loss, retention, and drill age. Engine-level tests cover invalid/overflowing timeout diagnostics, disabled archiving, invalid retained policies, and valid timeout boundaries. Existing parser syntax and zero-valued PostgreSQL settings remain supported. Independent local agent review found no remaining issues.

Validation: targeted regression tests and just ci pass locally, including all Go tests, vet, lint, vulnerability/workflow checks, generated documentation verification, and the website build. All five GitHub CI checks pass on the updated head, including Docker E2E and native Linux/macOS/Windows smoke tests. Copilot's fresh Lite review reports no findings and confirms the earlier production-caller finding is resolved. Docker/remote-host E2E was not run locally.

Effect on the safety envelope

Oversized durations are refused rather than allowed to wrap into misleadingly short values. No new capability or host operation is introduced.

Checklist

• just check passes locally.
• Tests cover the new behaviour, including the failure paths.
• Generated documentation is current (just check verifies this).
• CLA acceptance is managed by the contributor and repository bot.

[Copilot]

Copilot review overview

🟢 Approval recommended

The overflow checks are correct, comprehensive, and covered by focused regression tests.

Review effort: Balanced
Findings: None

What changed in this PR

Prevents duration overflow from producing misleadingly short backup and PostgreSQL durations.

Changes:

• Adds overflow checks before duration multiplication.
• Rejects oversized positive-day backup windows.
• Adds boundary and backup-policy regression tests.

File	Description
internal/​app/​runtime.go	Safely parses PostgreSQL duration units.
internal/​app/​backup_schema.go	Caps whole-day positive durations.
internal/​app/​duration_limits_test.go	Tests valid boundaries and overflow rejection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

PostgreSQL overflow returns a parse failure that the production safety check silently ignores.

Review effort: Balanced
Findings: 1

Open (1)

• Handle archive_timeout overflow as an archiving issue · New

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Handle archive_timeout overflow as an archiving issue