One blocker before merge: the limiter keys on the proxy IP
Behind the load balancer every request shares req.ip, so all clients drain a single bucket. The bucket map also never evicts. Tests pass because they call the middleware directly, without a proxy hop.