Rate limiting with a token bucket

A guard in /rate-limit/api runs before every route below it and gives each IP address a bucket of 5 tokens. Every request takes one, and 1 token per second flows back in. Short bursts pass, but a client sending faster than that runs dry and gets 429 Too Many Requests with a Retry-After header, before the route even runs.

Each response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers, which drive the bucket below. Fire a burst to empty it, then watch it refill.

The buckets live in the memory of one server process. With several instances, keep them in a shared store like Redis, so all instances count together.