fix(security): rate limiter fail-closed on Redis error, add Prometheus counter (#895)

[Vincent6581]

Summary

Resolves solutions-plug#895.

The newsletter subscribe rate limiter returned true (allow) whenever Redis was unavailable. A Redis outage silently became an open door for newsletter spam or brute-force abuse — the opposite of the intended safety policy.

This PR inverts the error path to fail-closed (deny → 429), adds a Prometheus counter so operators are alerted during Redis degradation, and documents the fail-closed vs fail-open tradeoff inline.

---

Changes

services/api/src/newsletter.rs

Fail-closed behaviour

• IpRateLimiter::allow() now returns false (deny → HTTP 429) on any Redis error instead of true (allow)
• Log message updated to explicitly state fail-CLOSED semantics

Prometheus counter

• Add optional metrics: Option<Metrics> and name: String fields to IpRateLimiter
• Add IpRateLimiter::with_metrics(cache, metrics, name) constructor for production use
• On every Redis error: metrics.observe_rate_limiter_redis_error(&self.name) increments rate_limiter_redis_errors_total{limiter="newsletter_subscribe"}
• Existing IpRateLimiter::new(cache) constructor still works (metrics = None)

Documentation

• Added module-level doc block explaining:
  • Why fail-closed is correct for security-critical rate limiters
  • When fail-open might be acceptable (non-security, read-only endpoints)
  • How to alert on rate_limiter_redis_errors_total

Test

• limiter_fails_closed_when_redis_unavailable: creates a limiter pointed at port 16399 (nothing listening), calls allow(), asserts false is returned — confirms fail-closed path returns 429

services/api/src/metrics.rs

• Add rate_limiter_redis_errors: IntCounterVec field with label limiter
• Register rate_limiter_redis_errors_total with the Prometheus registry
• Add observe_rate_limiter_redis_error(limiter: &str) public method

---

Acceptance criteria

• Redis failure behaviour changed to fail-closed (return 429) for newsletter subscribe
• rate_limiter_redis_errors_total Prometheus counter added, incremented on every Redis error
• Test verifies Redis timeout triggers fail-closed path and returns deny (false → 429)
• Fail-closed vs fail-open tradeoff documented in the rate limiting module

---

Alert recommendation

Add a CloudWatch metric filter + alarm on:

increase(rate_limiter_redis_errors_total[5m]) > 0

This will page on-call as soon as Redis degradation starts — before it escalates.