API rate limiting: patterns, algorithms, and how to do it right

Rate limiting looks trivial until you have more than one server, bursty traffic, or clients you care about. Token bucket vs sliding window, distributed limits, and honest 429s.