fix(rate-limiter): default USE_REDIS_RATE_LIMITER to True for multi-worker safety

[LaGodxy]

Summary

Closes #238

Why

USE_REDIS_RATE_LIMITER defaulted to False, forcing every deployment to use SimpleRateLimiter with an in-process dict. In a multi-worker Gunicorn setup each worker has its own memory space, allowing users to exceed rate limits by a factor of num_workers. The RedisRateLimiter implementation (including Lua-script sliding window, circuit breaker, and graceful fallback) was fully written but never activated.

What was built

File	Change
app/core/config.py	Changed USE_REDIS_RATE_LIMITER default from False to True
tests/test_rate_limiter_multiworker.py	5 new tests: default is True, module-level instantiation uses RedisRateLimiter when enabled, SimpleRateLimiter when disabled, SimpleRateLimiter when eager mode, shared class-level state demo

Integration changes outside <module>/

No new env vars. USE_REDIS_RATE_LIMITER is now True by default — Redis must be available at startup for rate limiting to work across workers. The existing circuit breaker fallback to in-memory (SimpleRateLimiter) handles Redis unavailability gracefully.

Acceptance criteria coverage

• Rate limiting is enforced consistently across multiple Gunicorn workers (default changed to True)
• Redis unavailability does not crash the application (existing circuit breaker fallback to in-memory SimpleRateLimiter)
• The existing test_rate_limiter_redis.py tests pass with the production implementation (no changes needed — they monkeypatch settings)

Deliberately deferred

• Per-user rate limit tiers (out of scope per issue)
• Middleware-level rate limiting (currently applied at auth endpoints only)

Test plan

• pytest tests/test_rate_limiter_redis.py — 3/3 passing
• pytest tests/test_rate_limiter_multiworker.py — 5/5 passing

Env vars / Notes

USE_REDIS_RATE_LIMITER now defaults to True. Set USE_REDIS_RATE_LIMITER=false in .env to force in-memory mode for single-worker local dev.