[nacx]

This PR has two commits.

1. Count REDIS_POOL_ON_EMPTY_BEHAVIOR=ERROR rejections in cmd_rejected

REDIS_POOL_ON_EMPTY_BEHAVIOR=ERROR and the Redis pool metrics were added separately. As a result, cmd_rejected counts commands rejected by REDIS_MAX_INFLIGHT, but not commands rejected because the pool has no connection. Those are counted in cmd_error instead. This commit counts both in cmd_rejected and updates its README entry.

It also extends the end-to-end outage test to check that no rate limit call is left in flight (call.should_rate_limit.inflight returns to 0).

2. Docs: Redis failover and unresponsive Redis

A new README section, "Redis failover and unresponsive Redis", describes how ratelimit behaves when Redis stops answering without closing its connections, for example after a failover that keeps the server's IP:

• How it is handled, layer by layer: request deadline, I/O timeout, TCP_USER_TIMEOUT, and readiness via the Redis health probe on /ready, with liveness staying on /healthcheck.
• Recommended settings for a Redis with failover (Sentinel, managed Redis such as GCP Memorystore or AWS ElastiCache, a Kubernetes Service in front of a primary).
• How to size the I/O timeout relative to normal Redis latency and to the client's own timeout (e.g. Envoy's rate limit filter timeout).
• Which metrics to alert on.

Testing

• go test -race ./... passes.
• The README table of contents is regenerated (doctoc).

🤖 Generated with Claude Code