Janitor evicts active keys almost immediately

Rate-limit tiers are how the product enforces its pricing model (e.g. free-tier: 10 requests/minute) and how infrastructure cost stays bounded under abuse. If configured state resets far more often than IDLE_TTL promises, free-tier usage stops being meaningfully capped -- costs that the pricing model assumed would be limited are not, and paying customers on higher tiers get no differentiated value from the tier they're paying for. Because this bug produces more allowed traffic rather than errors, it is one of the quietest possible failures to notice: nothing looks broken from the outside, the bill or the abuse just creeps up over time.

The janitor is supposed to delete only keys that have been idle for longer than idleTTL. Instead, it deletes keys almost immediately after they're created or touched -- well before idleTTL has actually elapsed -- which silently resets rate-limit state far too early.

tb := ratelimit.NewTokenBucketMemory(1, 0 /* no refill /, 2time.Second /* idleTTL */) tb.Allow(ctx, "user-1") // consumes the only token -> Allowed: true tb.Allow(ctx, "user-1") // Allowed: false, correctly denied (exhausted, no refill) time.Sleep(1300 * time.Millisecond) // well under idleTTL=2s, past at least one janitor sweep tick tb.Allow(ctx, "user-1") // got: Allowed: true -- the janitor silently evicted the entry and it was recreated fresh // want: Allowed: false -- the key was touched 1.3s ago, well inside the 2s idle window

This turns "idle key garbage collection" into "state silently resets on a timer regardless of activity," for every algorithm and both backends that embed a janitor. In production this means a client's rate limit quietly refreshes far more often than configured -- IDLE_TTL=1h (the documented default) would behave nothing like advertised, undermining every limit in the service.

Look at how cutoff is derived from time.Now() and j.idleTTL in (*janitor).run, and compare it to what "idle for longer than idleTTL" actually requires arithmetically (a point in the past, idleTTL behind now -- not ahead of it).