Effort dial sweep on one well-specified feature

You are working in the notes-api repository (Express 4, Node 20, node:test + supertest, ESLint). A Redis server is running for you at the URL in the REDIS_URL environment variable (db 0 is scratch space you may flush). Ticket API-88: Add a rate-limiter middleware. Create src/middleware/rateLimit.js exporting createRateLimiter(options) that returns Express middleware implementing a per-key token bucket stored in Redis, so that several app instances sharing one Redis share the same limits. Options: - redis: an ioredis client (required) - capacity: bucket size (max burst), integer - refillPerSec: tokens added per second (may be fractional) - keyFn(req): returns the bucket key; default is req.ip - prefix: Redis key prefix, default 'rl:' Behaviour: - Each request consumes one token. If a token is available, call next() and set X-RateLimit-Limit (capacity) and X-RateLimit-Remaining (tokens left, integer, after this request). - If the bucket is empty, respond 429 with JSON {"error":"rate_limited"}, a Retry-After header (whole seconds, rounded up, at least 1) and X-RateLimit-Remaining: 0. Do not call next(). - The check-and-consume must be atomic under concurrent requests, including across app instances. - Bucket keys must not live forever in Redis: give them a TTL. - If Redis fails (error or unavailable), fail open: let the request through and do not crash. Wire it into the app so that createApp({ rateLimit: { redis, capacity, refillPerSec, ... } }) applies the limiter to all /notes routes (not /health). Add thorough tests (at least 8), keep the existing tests passing, and make sure `npm run lint` is clean.