Token-bucket admission control built on golang.org/x/time/rate. Three flavors: global limiter, per-key LRU-bounded limiter (per-tenant or per-user), and distributed limiter (Redis/etcd via your own implementation).