[#1145] Add fail-safe rate limiting for distributed store outages - #1161

Summary

• add an explicit distributed rate-limit outage policy with secure fail-closed and opt-in fallback modes
• bound fallback requests, window duration, and local bucket cardinality so an outage cannot create an unbounded memory sink
• reset isolated local counters on recovery and resume distributed decisions without merging stale fallback state
• publish outage counters and current degraded state for operational alerting
• document configuration and add failure-injection coverage for outage, burst, recovery, eviction, redaction, metrics, and config validation

Acceptance criteria

• Protected routes fail closed by default when the distributed store is unavailable.
• Fallback mode is explicit, bounded, and documented.
• Recovery uses the distributed store again and discards local outage counters.
• Tests cover outage, burst, recovery, repeated failures, key isolation, and operational metrics.

Validation

• npm test -- --runInBand src/services/rateLimiter.test.ts src/services/rateLimiter.resilience.test.ts src/config/env.test.ts src/config/index.test.ts (70 tests passed)
• npx eslint src/services/rateLimiter.ts src/services/rateLimiter.resilience.test.ts src/config/env.ts src/config/env.test.ts src/config/index.ts src/config/index.test.ts src/metrics.ts
• npm run typecheck (blocked by pre-existing syntax errors in src/routes/refresh-token.test.ts:445)

Note: this repository’s distributed limiter is PostgreSQL-backed rather than Redis-backed; the policy is implemented at the shared RateLimiterStore boundary so it covers the configured distributed backend.

Closes #1145