Implement a Configurable Rate Limiter Middleware

Implement a flexible, production-grade rate limiter in [PROGRAMMING_LANGUAGE] for a [FRAMEWORK] web application. The rate limiter will protect [API_TYPE] API endpoints from abuse and ensure fair usage across clients. Please provide a complete implementation covering the following requirements: 1. **Algorithm Support**: Implement the following rate limiting algorithms and allow switching between them via configuration: - **Token Bucket**: With configurable bucket size and refill rate. - **Sliding Window Log**: With precise per-second tracking. - **Fixed Window Counter**: As a lightweight alternative. Clearly comment the trade-offs of each algorithm in the code. 2. **Storage Backends**: Design the rate limiter with a storage interface/abstraction so it supports: - In-memory storage (using a hash map with automatic expiry) for single-instance deployments. - [DISTRIBUTED_STORE] (e.g., Redis, Memcached) for distributed/multi-instance deployments. Provide concrete implementations for both backends. 3. **Client Identification**: Identify clients using a configurable key strategy that supports: IP address, API key from the `[HEADER_NAME]` header, authenticated user ID, or a composite key combining multiple identifiers. Include handling for clients behind proxies using `X-Forwarded-For`. 4. **Tiered Rate Limits**: Support different rate limit tiers based on [TIER_CRITERIA] (e.g., user subscription plan, API key type). Example tiers: - Free: [FREE_LIMIT] requests per [TIME_WINDOW] - Pro: [PRO_LIMIT] requests per [TIME_WINDOW] - Enterprise: [ENTERPRISE_LIMIT] requests per [TIME_WINDOW] 5. **Response Headers & Behavior**: When rate limited, return HTTP 429 with a JSON error body. Include standard headers: `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`, and `Retry-After`. Add these headers to all responses, not just rejected ones. 6. **Middleware Integration**: Package the rate limiter as a reusable middleware for [FRAMEWORK] that can be applied globally, per-route, or per-route-group with different configurations. 7. **Testing**: Include unit tests for each algorithm verifying correct counting, window expiration, and edge cases like concurrent requests. Provide the complete code with inline documentation, a usage example showing per-route configuration, and a brief section on monitoring rate limit metrics in production.