### Summary

The dynamic rate limiter is fail-open for unexpected errors. A Redis failure, cache exception, malformed counter response, or unexpected implementation error can make a request pass without dynamic rate-limit enforcement

### Current behavior

`_check_model_saturation()` catches every exception, logs it, and returns `0.0`, which represents an empty model

`async_pre_call_hook()` also catches every non-HTTP exception from the saturation and rate-limit checks, logs that it is allowing the request, and returns `None`

This is distinct from an intentional no-model-config case and from normal HTTP 429 handling

### Reproduction

Enable the dynamic rate limiter for a model with a configured RPM or TPM limit. In a unit test or failure injection environment, make either the saturation cache read or the rate-limit operation raise:

~~~python limiter._get_saturation_value_from_cache = AsyncMock( side_effect=RuntimeError("Redis unavailable") ) ~~~

Call `async_pre_call_hook()` with a valid key and model. The hook returns `None` instead of rejecting or surfacing the infrastructure failure. If the error occurs in `_check_rate_limits()`, the outer exception handler has the same …