Fix availablePermits() returning value greater than rate after release() and expiration - #7334

Fixes #7329

Problem

When a permit is acquired, released, and then expires from the sorted set, availablePermitsAsync() adds the expired permit count twice:

1. release() already restored the permit and clamped currentValue to rate
2. After the interval elapses, the sorted set entry (which release() did not prune) is counted as expired and added again — without any clamp

This causes availablePermits() to return a value greater than the configured rate, and that over-limit value is persisted back to Redis.

Root cause

availablePermitsAsync() line 592 adds released to currentValue with no rate ceiling:

currentValue = tonumber(currentValue) + released;
redis.call('set', valueName, currentValue);

releaseAsync() (line 303) already has the clamp:

if newValue > tonumber(rate) then
    newValue = tonumber(rate);
end;

Fix

Apply the same clamp in availablePermitsAsync() after adding expired permits but before persisting currentValue.

Testing

The existing testRelease() didn't catch this because it runs fast enough that no permits reach the expiration point (released = 0). Two new tests sleep past the interval to trigger the double-counting path and assert the clamp holds.

Note: I don't have Docker installed locally, so I couldn't run the RedisDockerTest-based tests. The fix has been verified by:

• Compiling both main and test code without errors
• Manually tracing the Lua script arithmetic (documented in the issue comment)
• CI will run the full integration tests