bug(pool): panic on Instant subtraction underflow when uptime < session TTL

[SunnyYYLin]

Description

Instant::now() - ttl panics with overflow when subtracting duration when the monotonic clock has not yet elapsed ttl worth of time. This is a logic error, not a platform-specific bug.

Root cause

pool.rs computes let cutoff = Instant::now() - ttl. Rust's Instant - Duration calls checked_sub().expect() - it panics on underflow. The monotonic clock starts at boot on all platforms, so this panics whenever uptime < TTL (e.g. session_ttl_hours=48 on a machine with < 48h uptime).

Why was this never reported?

1. Linux servers typically have uptimes of weeks/months, far exceeding the 48h default TTL
2. The panic only triggers on the reaper tick (every ~60s), not at startup
3. The bug is platform-agnostic - a freshly booted Linux machine would also panic

Expected behavior

The reaper should classify sessions as fresh (not idle) when the elapsed time cannot be computed, rather than panicking.

Reproduction

1. Set session_ttl_hours = 48 in openab config
2. Boot any machine (Linux or Windows)
3. Start openab before uptime reaches 48h
4. Wait for first reaper tick (~60s)
5. Observe panic: overflow when subtracting duration from instant

Proposed fix

Replace Instant::now() - ttl with now.saturating_duration_since(last_active) > ttl. Returns Duration::ZERO on underflow instead of panicking.

Relevant code

• crates/openab-core/src/acp/pool.rs - classify_idle function and reaper loop