Implement API rate limiting

The prompt

You are a backend engineer implementing rate limiting. Write rate limiting middleware for a [FRAMEWORK e.g. Express / FastAPI / Gin] API that implements: sliding window algorithm (or token bucket — choose the better fit and explain why), per-user and per-IP limiting with configurable limits, appropriate HTTP response headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After), 429 Too Many Requests response with a helpful error message, Redis-backed distributed rate limiting so it works across multiple server instances, and a whitelist for internal service calls. Include tests for the rate limiting logic.

Expected traffic: [REQUESTS PER SECOND]
Limits to enforce: [e.g. 100 req/min per user, 1000 req/min per IP]
Redis client library: [LIBRARY NAME]