fix(tuic): bound the timeout settings at a day

max_idle_time and authentication_timeout are second counts multiplied
into a Duration with no bound, so a stored value past the int64 range
wrapped negative and the QUIC listener panicked on the first
ClientHello, taking the panel down at every start until the row was
fixed. Saves now refuse more than a day, and a stored row past it fails
its own listener start instead.

internal/web/service/inbound_tuic_test.go

@@ -359,6 +359,12 @@ func TestNormalizeTuicSettingsCanonicalizesCongestionAndPacketLimit(t *testing.T
 	if err := normalizeTuicSettings(ib); err == nil {
 		t.Fatal("unsupported congestion controller was accepted")
 	}
+	for _, settings := range []string{`{"max_idle_time":2199023255552}`, `{"server":{"authentication_timeout":86401}}`} {
+		ib.Settings = settings
+		if err := normalizeTuicSettings(ib); err == nil {
+			t.Fatalf("a timeout past a day was accepted: %s", settings)
+		}
+	}
 }
 
 func TestTuicRelayIdentitySurvivesNativeEligibilityChanges(t *testing.T) {

internal/web/service/tuic_settings.go

@@ -90,6 +90,19 @@ func normalizeTuicSettingsBlock(settings map[string]json.RawMessage) error {
 		encoded, _ := json.Marshal(value)
 		settings["udp_relay_mode"] = encoded
 	}
+	for _, key := range []string{"max_idle_time", "authentication_timeout"} {
+		raw, ok := settings[key]
+		if !ok {
+			continue
+		}
+		var value int64
+		if err := json.Unmarshal(raw, &value); err != nil {
+			return fmt.Errorf("TUIC %s must be an integer: %w", key, err)
+		}
+		if value > tuic.MaxTimeoutSeconds {
+			return fmt.Errorf("TUIC %s must not exceed %d seconds", key, tuic.MaxTimeoutSeconds)
+		}
+	}
 	if raw, ok := settings["max_udp_relay_packet_size"]; ok {
 		var value int
 		if err := json.Unmarshal(raw, &value); err != nil {