Rate Limiters

429 Too Many Requests: how a token bucket decides who waits and who passes. Show: burst allowance, refill rate, and what happens when a client hammers the API. Include the X-RateLimit-Remaining header and the difference between per-IP and per-key limiting.