`golang.org/x/time/rate` provides a battle-tested token-bucket limiter. Use to enforce "N requests per second with bursts up to B" — for per-IP throttling, external API rate limits, etc.
A dirt-simple rate limiter that throttles per-key using a token bucket persisted to a JSON file. Good for single-server protection of expensive endpoints; reach for Redis when you scale out.