Rate-limiting anonymous users with no login, no Redis — just a cookie and an IP (opens in new tab)

I let people use my app before they sign up — upload a photo, get outfit feedback, no account needed. Great for conversion, right up until you remember every one of those anonymous calls hits a paid vision API. So I needed a free tier with a hard ceiling: 3 analyses per day per person, where "person" has no user ID, no session, and no reason to be honest about who they are. The usual answer for the counting part is "spin up Redis and do a sliding window." But counting was never the hard probl...