fix(multiplayer): serve queue candidates when Redis is down, not just empty

Closes part of the 'live Redis failover' gap in §8.46, found by
reproducing a genuine Redis outage (not just an empty/partial cache)
against CandidateProjection.Snapshot with a killed miniredis instance.

CandidateProjection.Snapshot funnelled two different situations into
the same code path: the index erroring outright (Redis unreachable)
and the index coming back empty (ambiguous — a genuinely empty queue,
or a lost keyspace). Both went through Repair, which itself calls
Index.Rebuild — a second Redis round-trip that fails for exactly the
same reason the first one did. The result: a real Redis outage, or
the window during a failover, made Snapshot fail outright even though
PostgreSQL — the documented authoritative source everywhere
(RedisCandidateIndex's own comment, cmd/matcher, cmd/control-plane's
--redis-addr help text all call it a rebuildable/optional
acceleration layer) — was completely healthy. Matchmaking would stop
entirely on a Redis outage despite the architecture explicitly not
requiring that.

Snapshot now falls back to serving Source (PostgreSQL) directly
whenever the index errors OR comes back empty, and only best-effort
attempts to repopulate Redis afterward — that attempt's outcome is
deliberately ignored, since a caller must never be denied service
just because the opportunistic rebuild also hit the same down Redis.
Snapshot still fails when Source itself is unavailable; the fallback
is not unconditional.

Verified: reproduced the bug first (killed-miniredis Snapshot call
failed even though Source was healthy), then fixed it. go build/vet
clean; all pre-existing store-package tests pass unmodified,
including the two live-redis:7-alpine-container tests
(TestRealRedisCandidateIndexUpsertSnapshotRemove,
TestRealRedisCandidateProjectionRepairsAfterFlush, run against a real
container and torn down after). Two new tests cover the fallback
directly (killed miniredis, Source still served, exactly one Source
call) and that the fallback is not unconditional (both Redis and
Source down still fails). Full go test ./... -race clean across
every server package.

Remaining: live matcher-worker-under-load-during-failover integration,
i.e. running the actual matcher process against a real Redis that
goes down mid-run under concurrent load, not just this unit-level
reproduction.

server/store/redis_candidates.go

@@ -43,27 +43,38 @@ func (p CandidateProjection) Repair(ctx context.Context, now time.Time) error {
 	return p.Index.Rebuild(ctx, candidates)
 }
 
+// Snapshot never fails just because Redis specifically is unreachable.
+// RedisCandidateIndex is documented everywhere (this type's own comment,
+// cmd/matcher, cmd/control-plane's --redis-addr help text) as an optional,
+// rebuildable acceleration layer over PostgreSQL authority -- but until this
+// fix, a genuine Redis outage (not merely an empty or partial cache, an
+// actual connection failure) made Snapshot fail outright: the old code
+// treated "the index errored" and "the index came back empty" identically,
+// funnelling both into Repair, which itself calls Index.Rebuild -- a second
+// Redis round-trip that fails for exactly the same reason the first one did.
+// A Redis failover or restart would have taken matchmaking down completely
+// even though the authoritative Source (PostgreSQL) was perfectly healthy.
+// Now: an index error or an empty read both fall back to serving Source
+// directly, and only attempt to repopulate Redis on a best-effort basis --
+// its outcome is deliberately ignored, since a caller must never be denied
+// service just because the rebuild's own Redis write also failed.
 func (p CandidateProjection) Snapshot(ctx context.Context, now time.Time) ([]domain.Candidate, error) {
 	if p.Source == nil {
 		return nil, fmt.Errorf("invalid candidate repair source")
 	}
 	candidates, err := p.Index.Snapshot(ctx, now)
-	if err == nil {
-		// An empty index is indistinguishable from a Redis restart or a lost
-		// keyspace. Rebuild from PostgreSQL before returning so queued players
-		// are not hidden until the next enqueue mutation.
-		if len(candidates) == 0 {
-			if err := p.Repair(ctx, now); err != nil {
-				return nil, err
-			}
-			return p.Index.Snapshot(ctx, now)
-		}
+	if err == nil && len(candidates) > 0 {
 		return candidates, nil
 	}
-	if err := p.Repair(ctx, now); err != nil {
-		return nil, err
+	// Either the index errored outright, or came back empty -- indistinguishable
+	// from a Redis restart or a lost keyspace. Consult PostgreSQL, the
+	// authoritative source, either way.
+	source, sourceErr := p.Source(ctx, now)
+	if sourceErr != nil {
+		return nil, sourceErr
 	}
-	return p.Index.Snapshot(ctx, now)
+	_ = p.Index.Rebuild(ctx, source)
+	return source, nil
 }
 
 func (r RedisCandidateIndex) keys() (string, string) {