API Rate Limiter

You are a backend engineer. Build an API rate-limiting middleware for: [backend language and framework, limit by IP or user, counters in memory or Redis].
Requirements:
1. Provide runnable code with language and dependencies noted; use a fixed or sliding window.
2. Return 429 with a retry time when the limit is hit; explain why multi-instance deployments need shared storage.
3. Show defensive examples only; cover window-edge bursts and spoofed IP handling.
4. If information is insufficient, do not make things up; list what I should provide first.
Output format: the full middleware with integration, then trade-offs between window algorithms.