Address CodeRabbit review feedback

- Guard the window conversion against TimeSpan overflow. FromHours(int.MaxValue)
  throws, and PapercutServiceModule only handles a failed ExecutionResult, so
  "1/2147483647h" in config took down service startup instead of falling back
  to no limit. Now reported as a parse failure, with tests.
- Read the clock inside the rate limiter's lock. A timestamp captured outside
  it can predate a _windowStart another thread already advanced, giving a
  negative elapsed and an inflated RetryAfter.
- Move the rate limit env vars out of the IP allowlist section in DOCKERHUB.md;
  they had orphaned the indented allowlist examples below them.
- Tag the SMTP response fence in docs/service.md as text.

Author: Jaben

DOCKERHUB.md

@@ -1,4 +1,4 @@
-![Papercut Logo](https://raw.githubusercontent.com/ChangemakerStudios/Papercut/develop/graphics/PapercutLogo.png)<br>
+![Papercut Logo](https://raw.githubusercontent.com/ChangemakerStudios/Papercut/develop/graphics/PapercutLogo.png)<br>
 *The Simple Desktop Email Helper*
 
 ## The problem
@@ -90,13 +90,13 @@ docker run -d \
 - `SmtpServer__MessagePath` - Path where emails are stored (default: /app/Incoming)
 - `SmtpServer__LoggingPath` - Path for log files (default: /app/logs)
 - `SmtpServer__AllowedIps` - IP allowlist for SMTP connections (default: "*" = all IPs allowed)
+- `SmtpServer__RateLimit` - Message reception rate limit as `<count>/<window>`, e.g. `500/1h` (default: "*" = no limit)
+- `SmtpServer__RateLimitReplyCode` - SMTP reply code returned once the rate limit is hit (default: 451)
 - `Urls` - HTTP server URLs (default: http://0.0.0.0:8080)
 - `HttpPathPrefix` - Serve the web UI and API under a path prefix, e.g. `/webmail` (default: empty = serve at root)
 
 **Security - SMTP IP Allowlist Configuration:**
 - `SmtpServer__AllowedIps` - Comma-separated list of allowed IP addresses or CIDR ranges for SMTP connections
-- `SmtpServer__RateLimit` - Message reception rate limit as `<count>/<window>`, e.g. `500/1h` (default: "*" = no limit)
-- `SmtpServer__RateLimitReplyCode` - SMTP reply code returned once the rate limit is hit (default: 451)
   - `*` - Allow all IPs (default, backward compatible)
   - `192.168.1.0/24` - Allow single CIDR range
   - `192.168.1.0/24,10.0.0.0/8` - Allow multiple CIDR ranges

docs/service.md

@@ -1,4 +1,4 @@
-# Service & Web UI
+# Service & Web UI
 
 The **Papercut SMTP Service** is an optional background component that receives email even when the desktop app isn't running — as a Windows Service or a [Docker container](docker.md) — and includes a browser-based UI for viewing messages.
 
@@ -82,7 +82,7 @@ for example `500/1h`, `5/10m`, or `100/30s`. Use `*` (the default) for no limit.
 
 Once the limit is reached, Papercut rejects at `MAIL FROM` until the window resets:
 
-```
+```text
 451 4.7.1 Message rate limit exceeded (500 per hour)
 ```
 

src/Papercut.Infrastructure.Smtp/RateLimiting/SmtpRateLimit.cs

@@ -140,14 +140,31 @@ private static ExecutionResult<TimeSpan> ParseWindow(string window)
 
         return char.ToLowerInvariant(unit) switch
         {
-            's' => ExecutionResult.Success(TimeSpan.FromSeconds(amount)),
-            'm' => ExecutionResult.Success(TimeSpan.FromMinutes(amount)),
-            'h' => ExecutionResult.Success(TimeSpan.FromHours(amount)),
+            's' => FromUnits(amount, TimeSpan.TicksPerSecond, window),
+            'm' => FromUnits(amount, TimeSpan.TicksPerMinute, window),
+            'h' => FromUnits(amount, TimeSpan.TicksPerHour, window),
             _ => ExecutionResult.Failure<TimeSpan>(
                 $"Invalid rate limit window unit '{unit}'. Expected s (seconds), m (minutes), or h (hours).")
         };
     }
 
+    /// <summary>
+    /// Converts a whole number of units into a TimeSpan, reporting a failure rather than
+    /// throwing when the result would not fit. TimeSpan.FromHours(int.MaxValue) overflows,
+    /// and an exception escaping here would take down service startup instead of falling
+    /// back to no limit.
+    /// </summary>
+    private static ExecutionResult<TimeSpan> FromUnits(int amount, long ticksPerUnit, string window)
+    {
+        if (amount > TimeSpan.MaxValue.Ticks / ticksPerUnit)
+        {
+            return ExecutionResult.Failure<TimeSpan>(
+                $"Rate limit window '{window}' is too large.");
+        }
+
+        return ExecutionResult.Success(new TimeSpan(amount * ticksPerUnit));
+    }
+
     private static string DescribeWindow(TimeSpan window)
     {
         if (window.TotalHours >= 1 && window.TotalHours % 1 == 0)

src/Papercut.Infrastructure.Smtp/RateLimiting/SmtpRateLimiter.cs

@@ -54,10 +54,12 @@ public RateLimitDecision TryAcquire()
             return new RateLimitDecision(true, 0, TimeSpan.Zero);
         }
 
-        var now = timeProvider.GetUtcNow();
-
         lock (this._sync)
         {
+            // Read the clock inside the lock: a timestamp captured outside it can be
+            // older than a _windowStart another thread has already advanced, which
+            // yields a negative elapsed and an inflated RetryAfter.
+            var now = timeProvider.GetUtcNow();
             var elapsed = now - this._windowStart;
 
             if (this._count == 0 || elapsed >= this.Limit.Window)

test/Papercut.Infrastructure.Smtp.Tests/RateLimiting/SmtpRateLimitTests.cs

@@ -119,6 +119,30 @@ public void Create_WithInvalidSpec_ReturnsFailureWithError(string spec)
         result.Errors.Should().NotBeEmpty();
     }
 
+    [TestCase("1/2147483647h")]
+    [TestCase("1/999999999h")]
+    public void Create_WithWindowTooLargeForTimeSpan_ReturnsFailureRatherThanThrowing(string spec)
+    {
+        // Act -- TimeSpan.FromHours(int.MaxValue) overflows; an exception escaping here
+        // would take down service startup instead of falling back to no limit
+        var result = SmtpRateLimit.Create(spec);
+
+        // Assert
+        result.IsFailed.Should().BeTrue();
+        result.Errors.Should().NotBeEmpty();
+    }
+
+    [Test]
+    public void Create_WithLargestWindowThatStillFits_ReturnsSuccess()
+    {
+        // Act -- int.MaxValue minutes is within TimeSpan's range and must keep working
+        var result = SmtpRateLimit.Create("1/2147483647m");
+
+        // Assert
+        result.IsSuccess.Should().BeTrue();
+        result.Value.Window.Should().Be(TimeSpan.FromMinutes(2147483647L));
+    }
+
     #endregion
 
     #region Reply Code Tests