[vinsymoyya]

Serialize the LDAP shadowExpire = -1 sentinel as an empty account-expiration field in the files cache, as required by shadow(5), instead of writing the literal -1. The map entry is left unchanged, and configured positive expiration dates retain their current output.

Fixes #109.

Added a BytesIO regression for missing, disabled, and positive expiration values. On current main (10fbf8a803f32c0007aa13d83179681a115299ac), the disabled case fails with root:*::::::-1:; the fix emits root:*:::::::.

Validation:

• 103 tests pass on Debian Linux / Python 3.11 with real python-ldap installed: python3 -m pytest -q nss_cache/sources/ldapsource_test.py nss_cache/maps nss_cache/util/file_formats_test.py nss_cache/caches/files_test.py. No tests excluded from that run.
• The focused negative control fails against the original production code for expire=-1; missing and positive values pass before and after the fix.
• Black 22.12.0 (matching the hosted formatter's major version) and git diff --check pass. The contribution guide's YAPF guidance predates the current Black workflow; the final test follows the file's existing Black style.
• No live LDAP server integration or full dependency-heavy suite was run locally. Hosted checks are separate from these local results.

Reference: https://man7.org/linux/man-pages/man5/shadow.5.html documents an empty account-expiration field as no expiration.