fix(limits): never fabricate zero counters, bound the rejection counter

Two correctness fixes from adversarial verification.

providerUsage returned every counter at its zero value on a
failed-closed store read, with no signal distinguishing that from a
real zero. metrics.go rendered the zero as a hard value. A single
Redis blip therefore read as a counter reset, and the recovery scrape
counted the whole prior total as a fresh increase, painting a phantom
multi-thousand-request spike from one transient error. Add storeDown
to providerCounters and set it on the failed-closed path, mirroring
scopeUsage's existing contract.

limiter.rejections grew without bound: nothing ever removed a scope
whose user was renamed or deleted from a hot-reloaded users file, so a
long-running process kept exporting a series for every name ever seen.
Bound the map with the same current/previous generation-rotation
authFailureTracker already uses, and evict a user's entry when
authStore.maybeReload performs a real reload. maybeReload now returns
whether it actually reloaded, so ServeHTTP only runs the eviction walk
on that rare event, never on every request.

Also corrects a stale comment: the rejection counter's store-down
branch fires on every request during a full outage, not rarely, as an
earlier comment claimed.

users_file.go

@@ -60,9 +60,21 @@ type gatewayLogger interface {
 // replaceFileUsers rejecting the new set — it logs via a.log.errorf and
 // keeps the last good set. A successful reload that changes the
 // file-sourced user count logs via a.log.logf.
-func (a *authStore) maybeReload() {
+//
+// Returns true only when a reload actually replaced the user set (review
+// fix, adversarial verification 2026-08-23) — every early-return path
+// above (no file configured, throttled, unchanged mtime, a stat/load
+// error, or replaceFileUsers itself rejecting the new set) returns
+// false. ServeHTTP uses this to gate limiter.pruneRejections: that call
+// walks every tracked rejection scope, which is cheap only relative to a
+// real reload (itself throttled to at most once per reloadEvery and
+// gated on the file's mtime actually changing) — running it on every
+// request regardless, the way maybeReload itself must, would add real
+// per-request cost to ServeHTTP's hottest path for a reason (deleted
+// users hot-reloaded out of the file) that is rare by construction.
+func (a *authStore) maybeReload() bool {
 	if a.usersFile == nil {
-		return
+		return false
 	}
 
 	// TryLock, not Lock: ServeHTTP calls maybeReload on every request, and a
@@ -74,33 +86,33 @@ func (a *authStore) maybeReload() {
 	// throttle window) covers it. Reload is deliberately best-effort and
 	// throttled, not "every change lands on the very next request."
 	if !a.reloadMu.TryLock() {
-		return
+		return false
 	}
 	defer a.reloadMu.Unlock()
 
 	now := a.nowFn()
 	if now.Sub(a.lastCheck) < reloadEvery {
-		return
+		return false
 	}
 	a.lastCheck = now
 
 	info, err := os.Stat(a.usersFile.path)
 	if err != nil {
 		a.log.errorf("llmgateway: cannot stat users file %q: %v", a.usersFile.path, err)
-		return
+		return false
 	}
 	// Equal, not After: an After-only check misses a backward mtime move —
 	// a restore from backup, or a `cp -p` from an older file. Any
 	// difference from the last observed mtime, forward or backward, must
 	// trigger a reload; only an unchanged mtime skips it.
 	if info.ModTime().Equal(a.lastModTime) {
-		return
+		return false
 	}
 
 	users, err := a.usersFile.load()
 	if err != nil {
 		a.log.errorf("llmgateway: users file %q reload failed: %v", a.usersFile.path, err)
-		return
+		return false
 	}
 
 	a.mu.RLock()
@@ -109,11 +121,12 @@ func (a *authStore) maybeReload() {
 
 	if err := a.replaceFileUsers(users); err != nil {
 		a.log.errorf("llmgateway: users file %q reload rejected: %v", a.usersFile.path, err)
-		return
+		return false
 	}
 	a.lastModTime = info.ModTime()
 
 	if len(users) != prevCount {
 		a.log.logf("llmgateway: users file %q reload: user count changed from %d to %d", a.usersFile.path, prevCount, len(users))
 	}
+	return true
 }