Hardened per-tenant rate limiting

Move the in-memory limiter to Redis so limits survive restarts and scale across instances.