Fix NULL deref in usUntilEarliestTimer when all time events are deleted (#15391)

Fixes #13992

## The problem

`usUntilEarliestTimer()` in `src/ae.c` scans the time event list for the
nearest non-deleted timer. It already guards the empty-list case (`if
(te == NULL) return -1;`), but when the list is non-empty yet every
event is marked `AE_DELETED_EVENT_ID`, the loop finishes with `earliest
== NULL` and the subsequent `earliest->when` access is a NULL pointer
dereference.

## The fix

Add `if (earliest == NULL) return -1;` after the scan, mirroring the
existing empty-list guard.

`-1` is the correct value here rather than `0`: the caller in
`aeProcessEvents()` treats a negative result as "no timer to wait for"
and leaves the poll timeout unset (blocking on I/O), whereas `0` would
make it poll with a zero timeout and busy-loop until the deleted events
are reclaimed.

Note: Harmless in practice — Redis always has the self-rearming
serverCron timer, so earliest is never NULL. This is defensive hardening
for the generic ae.c loop rather than a real crash fix.

src/ae.c

@@ -271,6 +271,11 @@ static int64_t usUntilEarliestTimer(aeEventLoop *eventLoop) {
         te = te->next;
     }
 
+    /* The list may hold only events marked AE_DELETED_EVENT_ID, leaving no
+     * earliest timer. Mirror the empty-list case above and report "no timer"
+     * instead of dereferencing a NULL earliest. */
+    if (earliest == NULL) return -1;
+
     monotime now = getMonotonicUs();
     return (now >= earliest->when) ? 0 : earliest->when - now;
 }