harden ember-server — auth rate limiting, pubsub limits, integer safety - #102

summary

hardens the server crate against several attack vectors and integer safety issues identified during security audit:

• auth brute-force protection: track failed AUTH attempts per connection, disconnect after 10 failures (matches Redis 6.2+ behavior). applied to both sharded and concurrent connection handlers.
• pub/sub subscription limits: cap subscriptions per connection at 10,000 to prevent memory exhaustion from broadcast channel creation. cap PSUBSCRIBE pattern length at 256 bytes to prevent pathological glob backtracking.
• slowlog integer safety: cap as_micros(), entry IDs, and timestamps with .min(i64::MAX) before casting to prevent silent truncation on very large values.
• drain_connections safety: use try_from with saturating fallback instead of bare as u32 cast on max_conn.

what was tested

• all 43 ember-server unit tests pass
• cargo clippy -p ember-server clean
• cargo check -p ember-server clean
• manual review of all as i64/as u32/as usize casts in the crate

design considerations

• auth failure counter is per-connection (not global) to avoid legitimate clients being locked out by another client's failures
• subscription limit of 10,000 is generous enough for any legitimate use case while preventing abuse
• pattern length of 256 bytes matches practical channel naming conventions; longer patterns almost certainly indicate abuse or a bug