fix: parse full-length numbers instead of truncating digit runs

[spokodev]

The number regex caps each digit run at {1,16}, so any value with more than 16 digits in a run is split into two matches: the first 16 digits match as one unitless number, and the leftover digits start a fresh match against whatever follows.

import parse from 'parse-duration'

parse('0.30000000000000004s') // => 4000.3   (expected 300.00000000000006)
parse('0.12345678901234567s') // => 7000.12… (expected 123.45678901234567)
parse('12345678901234567ms')  // => 1234567890123463 (expected 12345678901234567)

For '0.30000000000000004s' the fraction 30000000000000004 is 17 digits. The regex matches 0.3000000000000000 (16 fraction digits, i.e. 0.3) with an empty unit, so the compound-parsing loop treats it as bare ms (0.3), and the remaining 4s begins a new match worth 4 * 1000 = 4000. The two sum to 4000.3.

0.30000000000000004 is exactly String(0.1 + 0.2), so this fires on ordinary float-arithmetic results, and 300 is fully representable — the wrong answer is off by more than 13x, not a rounding artefact.

Root cause

The {1,16} bound was added in #61 to guard against ReDoS, replacing the earlier unbounded -?(?:\d+\.?\d*|\d*\.?\d+). The catastrophic backtracking in that pattern came from the two alternatives overlapping (both can match the same digits), not from the run length, so capping the length only masked it while introducing the truncation.

The alternation used here, (?:\d+(?:\.\d+)?|\.\d+), is unambiguous: the first branch requires a leading digit, the second requires a leading dot, so no input can be matched two ways. That removes the backtracking source, which lets the cap go without reintroducing ReDoS.

-const durationRE = /((?:\d{1,16}(?:\.\d{1,16})?|\.\d{1,16})(?:[eE][-+]?\d{1,4})?)\s*([\p{L}]{0,14})/gu
+const durationRE = /((?:\d+(?:\.\d+)?|\.\d+)(?:[eE][-+]?\d+)?)\s*([\p{L}]{0,14})/gu

Verification

• The three cases above now return the correct values.
• All existing tests pass; added assertions for long digit runs in test.js.
• ReDoS check: parsing a 200,000-digit input (and "1" + "0".repeat(100000) + " x") stays well under a millisecond.