fix(cli): reject out-of-range durations instead of overflowing

parse_duration_to_ms multiplied the parsed number by its unit
multiplier without a range check. A large --since value on
`openshell logs` overflows i64: a debug build panics with "attempt to
multiply with overflow", and a release build wraps to a nonsense log
cutoff.

Use checked_mul and return a diagnostic naming the offending input.
Every in-range result is unchanged, and the largest accepted duration
still leaves the caller's `now_ms - dur_ms` well inside i64.

Signed-off-by: Nathan DeMoss <ndemoss28@gmail.com>

Author: natedemoss

crates/openshell-cli/src/commands/common.rs

@@ -743,7 +743,9 @@ pub fn parse_duration_to_ms(s: &str) -> Result<i64> {
             ));
         }
     };
-    Ok(num * multiplier)
+    num.checked_mul(multiplier).ok_or_else(|| {
+        miette::miette!("duration out of range: {s} (must fit in milliseconds as a 64-bit integer)")
+    })
 }
 
 // ---------------------------------------------------------------------------
@@ -1073,6 +1075,24 @@ mod tests {
         assert!(err.to_string().contains("invalid duration"));
     }
 
+    #[test]
+    fn parse_duration_to_ms_rejects_out_of_range_values_without_overflowing() {
+        let err = parse_duration_to_ms("9223372036854775807h").expect_err("overflow should error");
+        assert!(err.to_string().contains("duration out of range"));
+
+        let err = parse_duration_to_ms("-9223372036854775808h").expect_err("overflow should error");
+        assert!(err.to_string().contains("duration out of range"));
+    }
+
+    #[test]
+    fn parse_duration_to_ms_accepts_the_largest_representable_duration() {
+        let max_hours = i64::MAX / 3_600_000;
+        assert_eq!(
+            parse_duration_to_ms(&format!("{max_hours}h")).expect("parse"),
+            max_hours * 3_600_000
+        );
+    }
+
     #[test]
     fn platform_progress_events_update_borrowed_display_without_duplicate_steps() {
         let event = PlatformEvent {