rate-limiting-quotas

Cost and abuse protection for an LLM-backed NestJS API - token and cost budget caps, concurrent stream limits, runaway agent loop guards, leaked key containment, token bucket and sliding window rate limits, @nestjs/throttler with Redis storage, reserve-and-settle token accounting, 429 with Retry-After and stable error codes, soft versus hard limits, and a when-you-grow section on per-tenant quotas and plans. Load when adding throttling, spend or token caps, stream concurrency limits, agent loop limits, or investigating runaway LLM cost or abuse.