Token Buckets, API Keys, and the Bug That Rate-Limited the Server

TL;DR The /api/v1/books/fetchbookmetadata endpoint had no abuse protection. Any client could spam ISBN lookups indefinitely, exhausting Google Books anonymous quota for every user. Implemented a han