Can I safely represent the counter that goes into each transaction to prevent a replay attack with a 32-bit two's complement integer, or a 64-bit one, or do I need a number type which is unbounded to represent the counter in the general case?
First of all, account's counter can't be greater than the global counter. The global counter grows with each manager operation. In other words, the global counter is the number of manager operations. Therefore, there is no max value.
For two years the global counter has reached ~6M, which is equal to ~3M per year.
Let's imagine, Tezos will process x10 operations in the future, it's 30M per year. In this case you can safely use single
int within the next
2^31 / 30M = 71 years =)
That being said, the internal representation in the node software uses an unbounded integer.