[WRONG BRANCH] fix(gui+server): reject out-of-range quota expiry timestamps

[luvs01]

Motivation

• A provider-controlled finite expiresAt could lie outside JavaScript's valid Date range and make Intl.DateTimeFormat.format(new Date(...)) throw, causing the Providers page to crash.

Description

• Tighten backend normalization by having epochMillis return undefined for timestamps that do not produce a finite Date (src/providers/quota.ts).
• Harden the GUI report adapter to accept expiresAt only when it converts to a valid Date and otherwise omit the optional expiry from the adapted creditsUsd shape (gui/src/provider-workspace/report.ts).
• Add regression coverage exercising an out-of-range Command Code currentPeriodEnd in the quota probe and GUI rendering paths and a GUI rendering test that verifies an out-of-range expiry is omitted (tests/command-code-quota.test.ts, gui/tests/provider-capacity.test.ts, gui/tests/provider-capacity-credits.test.tsx).

Testing

• Ran the focused backend Command Code quota tests with ./node_modules/.bin/bun test tests/command-code-quota.test.ts, which passed (13 tests).
• Ran focused GUI tests with cd gui && bun test tests/provider-capacity.test.ts tests/provider-capacity-credits.test.tsx, which passed (11 tests) and validated that out-of-range expiries are omitted and do not break rendering.
• Ran cd gui && bun run build, bun run typecheck, bun run privacy:scan, and cd gui && bun run lint, all of which succeeded; the repository-wide bun run test remains red due to unrelated pre-existing failures/timeouts and is not caused by this change.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 077018ce-0e2c-44d1-b05e-dd6e5c23780c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.