Fix unbounded inbound-message dedup set and un-unref'd timeout timer

inboundMessageIds was only ever cleared whole (on disconnect), so it grew
without bound proportional to total inbound message volume over a
connection's lifetime. Now capped at 5000 entries, evicting the oldest
(Set preserves insertion order) once exceeded.

withTimeout's internal setTimeout wasn't unref'd, unlike every other timer
in this file (qrTimer, reconnectTimer, the lease timer) — a pending
lookup/send timeout could keep the event loop alive if the process ever
tried to exit gracefully without an explicit process.exit().

Found via a full-project audit.

tests/whatsapp-manager.test.mjs

@@ -349,6 +349,38 @@ test('messages.upsert publica uma vez somente mensagens inbound novas de convers
   await fs.rm(f.authDir, { recursive: true, force: true });
 });
 
+// O Set de dedup so era esvaziado inteiro no disconnect: sem um teto,
+// crescia sem limite proporcional ao volume total de mensagens recebidas
+// durante a vida da conexao. Envia 1 mensagem a mais que o teto interno
+// (5000) e confirma que a mais antiga foi descartada (tratada como nova de
+// novo), provando que o Set nao cresce indefinidamente.
+test('dedup de mensagens inbound tem teto e descarta a mais antiga', async () => {
+  const inbound = [];
+  const f = await fixture({ onInboundMessage: (event) => inbound.push(event) });
+  await f.manager.connect();
+  const socket = f.sockets[0];
+  socket.ev.emit('connection.update', { connection: 'open' });
+
+  const TOTAL = 5001;
+  for (let i = 0; i < TOTAL; i++) {
+    socket.ev.emit('messages.upsert', {
+      type: 'notify',
+      messages: [{ key: { id: `msg-${i}`, remoteJid: '5575999091780@s.whatsapp.net', fromMe: false }, messageTimestamp: 1785326400 }]
+    });
+  }
+  await waitFor(() => inbound.length === TOTAL, 5000);
+
+  socket.ev.emit('messages.upsert', {
+    type: 'notify',
+    messages: [{ key: { id: 'msg-0', remoteJid: '5575999091780@s.whatsapp.net', fromMe: false }, messageTimestamp: 1785326400 }]
+  });
+  await waitFor(() => inbound.length === TOTAL + 1, 2000);
+  assert.equal(inbound.filter((e) => e.messageId === 'msg-0').length, 2);
+
+  await f.manager.close();
+  await fs.rm(f.authDir, { recursive: true, force: true });
+});
+
 test('falha ao persistir inbound nao escapa do EventEmitter nem gera resposta automatica', async () => {
   const logs = [];
   const f = await fixture({