fix: enable all skipped tests and implement fail-open rate limiting

- Enable 22+ previously skipped tests with proper mocking
- Change rate limiter to consistently fail-open when Redis unavailable
- Update rate_limiter_test to expect fail-open behavior (allows requests)
- Fix impossible nil check causing compiler error in error_logging_test
- Document case sensitivity in policy comparison operators
- Fix typo in cached_authorization.go comment

middleware/rate_limiter_test.go

@@ -180,6 +180,7 @@ func TestRateLimiterMiddleware_RedisNotAvailable(t *testing.T) {
 	handlerCalled := false
 	handler := middleware(func(w http.ResponseWriter, r *http.Request) {
 		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
 	})
 
 	req := httptest.NewRequest(http.MethodGet, "/test", nil)
@@ -190,12 +191,13 @@ func TestRateLimiterMiddleware_RedisNotAvailable(t *testing.T) {
 	resp := w.Result()
 	defer resp.Body.Close()
 
-	if resp.StatusCode != http.StatusServiceUnavailable {
-		t.Errorf("status = %v, want %v", resp.StatusCode, http.StatusServiceUnavailable)
+	// With fail-open behavior, requests should be allowed when Redis is unavailable
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("status = %v, want %v (fail-open behavior)", resp.StatusCode, http.StatusOK)
 	}
 
-	if handlerCalled {
-		t.Error("handler should not be called when Redis is not available")
+	if !handlerCalled {
+		t.Error("handler should be called when Redis is not available (fail-open)")
 	}
 }