Token-bucket rate limiter (no new dependencies) with three tiers: - Auth routes: 10 req/min, burst 5 (brute-force protection) - Trading/read routes: 200 req/min, burst 20 - Compute routes (backtest/training/tune): 30 req/min, burst 5 Includes background cleanup task for stale entries and 7 unit tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>