fix(gateway): saturate certificate lock expiry

[kvinwang]

Summary

Prevent overflow while calculating expiry for certificate-renewal and ACME-rotation leases. Saturating addition preserves a far-future lock instead of panicking in checked builds or wrapping to an expired timestamp.

Verification

• cargo fmt --all -- --check
• cargo test -p dstack-gateway lease_expiry_does_not_overflow -- --nocapture
• git diff --check

[Copilot]

Pull request overview

This PR hardens the gateway’s KV-based ACME lease/lock handling by preventing u64 overflow when computing lock expiry times, ensuring locks don’t accidentally appear expired (or panic in debug/checked builds).

Changes:

• Use saturating_add when computing certificate-renewal and ACME-rotation lock expiry.
• Add a regression test that writes a lock with started_at = u64::MAX and asserts acquisition correctly fails (lock remains held).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.