Build a rate limiter library with pluggable strategies

• A common RateLimiter interface: allow(key) returns { allowed, remaining, retryAfterMs }
• Implement three strategies: token bucket (capacity and refill rate), fixed window counter, and sliding window (log or sliding counter)
• Limits are per key (for example user id or IP), with independent state per key, and different rules can be assigned per key pattern or tier (free versus paid)
• Time comes from an injectable clock so behaviour can be tested deterministically without sleeping
• Concurrency safety: the check-and-update for a key is atomic (document why it is atomic in a single Node process, and what changes with an external store like Redis)
• Memory is bounded: idle keys are evicted after a timeout, so a stream of unique keys cannot grow memory forever
• A small Express-style middleware adapter that returns HTTP 429 with a Retry-After header

Only after every requirement works.

• A Redis-backed store using a Lua script for atomic updates
• Cost-based limits where one request can consume several tokens
• Metrics: counts of allowed and rejected requests per key