Fall back to an in-memory limiter when Redis is down

Rate limiting is meant to be a best-effort protection, not a hard dependency for whether an endpoint works at all. As built today, a Redis blip -- routine infra maintenance, a network hiccup, a failover -- takes down every protected endpoint with a 500, converting a minor, expected infrastructure event into a full customer-facing outage. That's a much larger blast radius than the actual failure warrants, and it directly threatens uptime SLAs for something that should, worst case, only make rate limiting slightly less accurate for a few minutes.

Every Redis-backed limiter's AllowN returns Result{}, err verbatim whenever client.Eval(...) fails, and middleware.RateLimit treats any error from the limiter as fatal to the request (a 500). A stub exists at pkg/ratelimit/fallback.go: NewWithFallback currently always defers to primary and returns its error untouched.

primary := &alwaysErroringLimiter{} // simulates a Redis outage fallback := ratelimit.NewTokenBucketMemory(10, 10, time.Minute) l := ratelimit.NewWithFallback(primary, fallback) res, err := l.Allow(ctx, "user-1") // got: err is the primary's error (simulated redis outage) -- the request fails // want: err is nil, res reflects the fallback limiter's decision

This is the classic graceful-degradation pattern: a non-critical dependency (the exact rate is best-effort; enforcing it slightly wrong for a few minutes during an incident is a much smaller problem than every request failing). Treating "the rate limiter's backend hiccuped" as equivalent to "the whole endpoint is down" is a common real-world overreaction that turns a minor infrastructure blip into a customer-facing outage.

This is a small, self-contained wrapper type -- no locking or shared state needed beyond holding references to the two child Limiters. Leave a doc comment noting the trade-off that a caller who wants to know they got a degraded decision (for logging/metrics) has no out-of-band signal for it in the current Limiter interface, the same way task-10 documents its own known limitation.