fix: Resilient Redis cache reads for rate limiting (#3455)

## Summary

- **Exclude actuator endpoints from rate limit filters** — health probes
(`/actuator/health`) no longer go through
`GlobalIpRateLimitFilter`/`GlobalUserRateLimitFilter`, preventing crash
loops when Redis cache entries are corrupted
- **Add `ResilientCacheAccessor` component** — catches `RedisException`
on direct `cache.get()` calls (not covered by `TolgeeCacheErrorHandler`
which only handles `@Cacheable`), evicts bad entries, returns `null`
(cache miss)
- **Integrate into `RateLimitService`** — corrupted Bucket entries are
treated as cache misses instead of 500 errors

### Root cause (v3.154.0 crash loop)

`Bucket` class gained `strikeCount`/`lastStrikeAt` fields → old
Kryo-serialized entries in Redis couldn't deserialize →
`KryoBufferUnderflowException` → health checks hit rate limit filter →
HTTP 500 → K8s restarts pod → crash loop.

### Defense in depth

| Layer | What it does | Protects against |
|-------|-------------|-----------------|
| Actuator bypass | Skips rate limiting for `/actuator/**` | Health
probe failures from any cache issue |
| ResilientCacheAccessor | Catches `RedisException`, evicts, returns
null | 500 errors on API requests from corrupted cache |

## Test plan

- [x] `ResilientCacheAccessorTest` — 5 tests (normal get, null return,
RedisException caught + eviction, non-Redis propagation)
- [x] `RateLimitServiceTest` — 15 tests including new `corrupted cache
entry is treated as cache miss`
- [ ] Full backend test suite (`server-app:runStandardTests`)
- [ ] Manual: start with Redis, corrupt a `rateLimits` entry, verify
graceful handling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Improved cache resilience: corrupted cache entries are evicted and
treated as misses to prevent runtime errors.
* Rate limiting now skips actuator endpoints so health and metrics
remain accessible (including when an application context path is set).

* **Tests**
* Added tests validating cache resilience, eviction on corruption,
null-handling, and exception propagation.
* Expanded rate limiting tests to verify actuator endpoint exemptions
and context-path handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Gabriel Shanahan <gabe@tolgee.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: 3 people

backend/data/src/main/kotlin/io/tolgee/component/CacheCleaner.kt

@@ -4,24 +4,15 @@ import io.tolgee.configuration.tolgee.TolgeeProperties
 import org.springframework.boot.context.event.ApplicationReadyEvent
 import org.springframework.cache.CacheManager
 import org.springframework.context.event.EventListener
-import org.springframework.core.annotation.Order
 import org.springframework.stereotype.Component
 
-/**
- * Clears all caches on startup when configured via [TolgeeProperties.cache.cleanOnStartup].
- *
- * This runs with @Order(100) to ensure [CacheSchemaCleaner] runs first (@Order(50)).
- * The schema cleaner handles revision-based cache clearing, while this component
- * provides a way to force-clear all caches if needed.
- */
 @Component
 class CacheCleaner(
   private val allCachesProvider: AllCachesProvider,
   private val cacheManager: CacheManager,
   private val tolgeeProperties: TolgeeProperties,
 ) {
   @EventListener
-  @Order(100)
   fun onAppStartup(event: ApplicationReadyEvent) {
     if (tolgeeProperties.cache.cleanOnStartup) {
       cleanCaches()

backend/data/src/main/kotlin/io/tolgee/component/ResilientCacheAccessor.kt

@@ -0,0 +1,58 @@
+/**
+ * Copyright (C) 2023 Tolgee s.r.o. and contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.tolgee.component
+
+import org.redisson.client.RedisException
+import org.slf4j.LoggerFactory
+import org.springframework.cache.Cache
+import org.springframework.stereotype.Component
+
+/**
+ * Provides resilient cache access for direct cache.get() calls.
+ *
+ * TolgeeCacheErrorHandler only covers @Cacheable annotations (Spring AOP).
+ * Code that calls cache.get() directly (e.g. RateLimitService) needs this
+ * component to handle deserialization errors gracefully.
+ *
+ * On RedisException (e.g. KryoBufferUnderflowException from schema changes),
+ * logs a warning, evicts the bad entry, and returns null (cache miss).
+ */
+@Component
+class ResilientCacheAccessor {
+  private val logger = LoggerFactory.getLogger(ResilientCacheAccessor::class.java)
+
+  fun <T> get(
+    cache: Cache,
+    key: Any,
+    type: Class<T>,
+  ): T? {
+    return try {
+      cache.get(key, type)
+    } catch (e: RedisException) {
+      logger.warn(
+        "Suppressing RedisException for cache {} on key {}. " +
+          "This is likely due to outdated cache data, therefore this cache entry has been removed. " +
+          "If this re-occurs for the same cache and key, it is likely from a bug that should be reported.",
+        cache.name,
+        key,
+      )
+      logger.warn("The following error occurred while fetching the key", e)
+      cache.evictIfPresent(key)
+      null
+    }
+  }
+}