Rate-limiting anonymous users with no login, no Redis — just a cookie and an IP

I let people use my app before they sign up — upload a photo, get outfit feedback, no account needed. Great for conversion, right up until you remember every one of those anonymous calls hits a paid v