feat: add Redis-backed shared rate limiting with in-memory fallback

[bh462007]

Description

Fixes #463

Implemented Redis-backed shared rate limiting with a graceful in-memory fallback.

The application previously relied on express-rate-limit's default in-memory store, which caused rate limit counters to reset after server restarts and prevented consistent enforcement across multiple server instances.

This change adds optional Redis support while keeping local development behavior unchanged.

Changes Made

• Added Redis-backed storage using rate-limit-redis when REDIS_URL is configured.
• Added Redis client initialization with a single shared connection.
• Updated all existing rate limiters to use Redis stores:
  • globalIpLimiter
  • authIpLimiter
  • otpIpLimiter
  • botIpLimiter
  • userRateLimiter
  • adminRateLimiter
• Added unique Redis key prefixes for each limiter to prevent counter collisions.
• Added graceful fallback to express-rate-limit's default in-memory store when:
  • REDIS_URL is not configured
  • Redis connection fails
  • Redis authentication fails
• Added optional REDIS_URL documentation in .env.example.

Implementation Details

• Redis connection is attempted once during startup.
• Disabled infinite reconnect attempts to avoid unnecessary logs when Redis configuration is invalid.
• Existing rate limits, windows, and response behavior remain unchanged.

Testing Done

Verified locally with a real Upstash Redis instance:

• ✅ Confirmed in-memory fallback works without REDIS_URL.
• ✅ Confirmed invalid Redis configuration does not crash the application.
• ✅ Confirmed Redis-backed rate limiting works when Redis is available.
• ✅ Verified Redis keys use separate prefixes for different limiters.
• ✅ Confirmed unrelated routes continue working normally.

Backward Compatibility

No breaking changes.

Local development continues working without requiring Redis configuration.

Related Issue

Closes #463

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.