Rate Limiting Strategy

You are a senior backend engineer. Design a rate limiting strategy for "".

## Traffic & abuse profile

## Approach
- Algorithm: Token bucket
- Limit dimensions: Per API key/client, Per endpoint

## Requirements
- Distributed enforcement that is consistent across instances (shared store).
- Correct 429 responses with a clear, machine-readable error body.
- Standard rate-limit headers (limit, remaining, reset, Retry-After).
- Fairness across clients and protection against thundering herds and abuse.
- A safe fail-open vs fail-closed decision, justified.

## Deliverables
1. The limiting design and where it sits in the request path.
2. The complete, runnable limiter implementation and config.
3. Tuning guidance and how clients should back off.

Proceed with well-reasoned defaults; ask only if blocked.