test(auth): stop starting the real-clock rate-limit test near a window edge

[jason931225]

The flake

otp_redeem_rate_limit_wires_up_on_real_clock_path drives ten requests expecting 401, then asserts the eleventh is 429:

assertion `left == right` failed: the trusted ingress identity must select the first per-IP bucket

Why it fails

The limiter buckets into a fixed one-minute tumbling window, not a sliding one — floor_to_window in crates/platform/auth-rest/src/lib.rs:

let floored = unix - unix.rem_euclid(window_secs);   // WINDOW = Duration::minutes(1)

So all eleven requests must land inside the same window. Each round-trips to PostgreSQL, so the test occupies a real fraction of that window — and whenever the loop straddles a minute boundary the counter resets mid-loop and the eleventh request becomes the new window's first, returning 401.

It did exactly that on run 32225725163, failing #802 — a PR that changes nothing near auth — and blocking it behind an unrelated red.

The fix

The sibling named in this test's own doc comment, rate_limit_trips_at_cap_and_resets_after_window, drives now directly and has no such exposure. This test exists to prove the real clock path is wired, so it cannot inject a clock — but it can decline to start near a boundary:

let into_window = OffsetDateTime::now_utc().unix_timestamp().rem_euclid(60);
if into_window > WINDOW_SECS - NEEDED_SECS {   // NEEDED_SECS = 30
    tokio::time::sleep(...).await;
}

The assertion is unchanged. This removes a timing dependency the test never meant to have, not a behaviour it meant to check.

Verification

cargo check -p console-app --tests, cargo fmt --check, cargo clippy --tests — all clean.

Unblocks

#802.

🤖 Generated with Claude Code