feat: harden limiter logic and expand Redis

[Saurabhsing21]

Summary

This PR improves the API rate-limit system for security, reliability, and maintainability.
It also simplifies maintainer setup to 2–3 core inputs while keeping advanced overrides available.

Issue

#526
The initial implementation worked, but had practical gaps:

• IP-based limits could be weakened if proxy/IP trust was misconfigured.
• Timing consistency needed stronger Redis-side guarantees.
• Some fallback/misconfiguration paths were too quiet.
• Config required too many env vars for normal usage.
• Test coverage missed key edge cases and deeper Redis behavior.

What Changed

• Hardened token bucket behavior and logging in /ENTS-backend/backend/api/rate_limit.py.
• Kept Redis Lua execution atomic and validated Redis-time-based behavior.
• Added safer rule fallback and misconfiguration warning behavior.
• Added blocked-request logging with redaction for sensitive identity values.
• Added memory-backend cleanup/expiry protections to avoid growth issues.
• Ensured rate-limit decorators are applied across uncovered resource methods.
• Added ProxyFix-driven trusted proxy support in /ENTS-backend/backend/api/__init__.py.
• Added JWT audience/issuer config support in /ENTS-backend/backend/api/config.py.

Config Simplification (2–3 Inputs)

A new profile-based model was introduced in /ENTS-backend/backend/api/config.py:

• RATE_LIMIT_ENABLED
• RATE_LIMIT_STORAGE_URI
• RATE_LIMIT_PROFILE (strict, balanced, relaxed)

Optional:

• RATE_LIMIT_TRUSTED_PROXY_COUNT (only when behind trusted proxies)
• Per-rule RATE_LIMIT_<RULE>_CAPACITY and RATE_LIMIT_<RULE>_REFILL_RATE (advanced tuning only)

Docs and examples updated:

• /Users/apple/Projects/ENTS-backend/.env.example
• /Users/apple/Projects/ENTS-backend/backend/README.md

Test Coverage

Expanded tests in /ENTS-backend/backend/tests/test_rate_limit.py:

• Existing behavior checks (capacity, headers, fallback, fail-open).
• Edge cases for identity priority, missing-rule behavior, rule normalization, retry rounding, expiry/reset.
• Redis backend unit coverage via mocks.
• Redis integration coverage against local Redis when available.

Validation

• ruff on touched files: passed.
• pytest /ENTS-backend/backend/tests/test_rate_limit.py: passed.
• Redis-enabled run: passed.

Backward Compatibility

• Default behavior remains availability-first (fail-open on backend runtime errors).
• Advanced per-rule env overrides are still supported.
• New RATE_LIMIT_PROFILE reduces setup complexity without removing tuning flexibility.

Reviewer Notes

Please focus on:

1. Profile defaults (strict / balanced / relaxed) for production traffic expectations.
2. RATE_LIMIT_TRUSTED_PROXY_COUNT value per deployment topology.
3. Final per-rule override policy (if any) for your environment.

[Saurabhsing21]

Hi @aleclevy Can you review this pr , this is not 100% perfect but pls review this and let me know what i have to improve

[Saurabhsing21]

@aleclevy Can you review this