Pull request description from a git diff

**Summary** Rate limiting for the public search endpoint moves from a per-process in-memory counter to a shared Redis counter, so the limit now applies across all application instances rather than per instance. **Files Changed** - `src/middleware/rate_limit.py` — replaces the module-level `defaultdict` with a Redis-backed sliding window. - `src/config.py` — adds `REDIS_URL` and `SEARCH_RATE_LIMIT_PER_MINUTE`, both required at startup. - `tests/test_rate_limit.py` — new tests covering the window boundary and the Redis-unavailable path. **Code Changes** The counter is now incremented and expired in one round trip: ```python pipe = redis.pipeline() pipe.incr(key) pipe.expire(key, WINDOW_SECONDS, nx=True) count, _ = pipe.execute() ``` `expire` uses `nx=True` so a long-running window is not reset by later requests inside it. **Reason for Changes** With four instances behind the load balancer, the effective limit was four times the configured value, and a client pinned to one instance saw a different limit from one spread across them. **Impact of Changes** The limit becomes accurate but Redis becomes a dependency of the request path. The middleware fails open — if Redis is unreachable it logs at `error` and allows the request, on the grounds that dropping traffic is worse than briefly under-enforcing a limit. Each search request now costs one extra round trip to Redis. **Test Plan** Run `pytest tests/test_rate_limit.py`. To verify across instances, start two app processes against one Redis, then send N+1 requests split between them and confirm the last is rejected. Stop Redis and confirm requests still succeed with an error logged. **Additional Notes** `REDIS_URL` has no default, so any deployment that does not set it will fail at startup rather than silently disabling the limit. Staging config needs updating before this merges.