Token bucket makes burst limits explicit

Store a token count and last-refill time. On each request, add tokens according to elapsed time, capped at the bucket capacity; allow the request only if a token remains, then subtract one. Capacity controls burst size, while refill rate controls sustained throughput. Use monotonic time so wall-clock adjustments don't distort elapsed time.