fix(uploads): finish a transfer when the file lands, not when the peer closes

The stress harness found this: 38 completed uploads logged as errors, and a
run that took 30s to move what should take 6.

After the last byte we waited up to 30 seconds for the downloader to close
the file connection. Soulseek does leave that close to the downloader, but a
peer that simply leaves the socket open — or whose FIN a NAT swallows — is
not a failure: it has every byte. We were marking those uploads Failed,
skipping the SendUploadSpeed report that sets our advertised speed, and
holding the upload slot the next peer was queued for.

Cutting the wait to five seconds was not enough, and stress said so: with
two slots and sixty-four queued leechers, five seconds apiece is a hundred
and sixty seconds of waiting, and ten uploads never got served inside the
run. The slot has to be free the moment the file is delivered, so the wait
is gone — Nicotine+ finishes the transfer there too and closes from its own
side. That profile went from 146s with ten uploads lost to 9.7s with none;
the default profile from 30.7s and 25 MiB/s to 5.8s and 133 MiB/s.

Also: a decompression ceiling on peer payloads, the numbers Nicotine+ uses
(128 MiB for a search or folder reply, 2 GiB for a browse listing). Deflate
reaches roughly 1000:1, so a few kilobytes from an unknown peer could
otherwise expand until the process died.

And the stress harness counted threads with `ps -M`, which is macOS
spelling: on Linux it returns one unrelated line, so the guard against
thread explosions has been reporting a single thread on CI all along.
/proc/self/status has the real number.

soulseek-rs-lib/src/message/peer/shared_file_list.rs

@@ -4,7 +4,7 @@
 
 use crate::message::{Message, MessageHandler};
 use crate::peer::PeerMessage;
-use crate::utils::zlib::{deflate, inflate};
+use crate::utils::zlib::{MAX_INFLATED_LISTING, deflate, inflate_limited};
 use std::sync::mpsc::Sender;
 
 /// One file in a shared directory: its basename, size and the `(code, value)`
@@ -68,7 +68,8 @@ pub fn build_shared_file_list(dirs: &[SharedDirectory]) -> Message {
 /// Returns an empty listing if the payload is malformed.
 #[must_use]
 pub fn parse_shared_file_list(message: &mut Message) -> Vec<SharedDirectory> {
-    decompress_body(message)
+    // A whole share listing is the one payload that legitimately runs large.
+    decompress_body(message, MAX_INFLATED_LISTING)
         .map_or_else(Vec::new, |mut body| read_directories(&mut body))
 }
 
@@ -135,11 +136,15 @@ pub fn read_directories(body: &mut Message) -> Vec<SharedDirectory> {
     dirs
 }
 
-/// Inflate a compressed peer payload positioned at the blob.
-pub fn decompress_body(message: &mut Message) -> Option<Message> {
+/// Inflate a compressed peer payload positioned at the blob, refusing one
+/// that expands past `max_out` — a peer we have never met chose these bytes.
+pub fn decompress_body(
+    message: &mut Message,
+    max_out: usize,
+) -> Option<Message> {
     let pointer = message.get_pointer();
     let size = message.get_size();
-    inflate(&message.get_slice(pointer, size))
+    inflate_limited(&message.get_slice(pointer, size), max_out)
         .ok()
         .map(Message::new_with_data)
 }