fix: validate stress event amounts

[pushkart2]

What changed

• reject non-numeric, NaN, non-positive, and oversized stress event amounts
• apply the same boundary to gain and relief events

Why

Network event arguments were used directly in metadata arithmetic. A client could send negative or non-finite values to invert the operation or poison stress state.

Validation

• git diff --check
• direct Lua control-flow and boundary review