Credential-stuffing protection

Design abuse/throttling protection for a login endpoint under credential-stuffing attacks. Attackers rotate across thousands of IPs and try many usernames, so per-IP limits alone don't catch them. You must throttle attackers hard while barely affecting legitimate users (a shared corporate NAT can put thousands of real users behind one IP). Design the multi-dimensional rate-limiting/throttling scheme and how you avoid false positives.