Distributed coupon endpoint attack

Your checkout API p99 jumps from 180ms to 9s and origin 5xx climbs to 30%. The edge (Cloudflare) dashboard shows requests/sec up 14x but bandwidth only up ~2x, small requests. The flood targets POST /api/cart/apply-coupon with valid-looking JSON, rotating across ~120k residential IPs, each doing 2-3 req/min so no single IP trips rate limits. The coupon endpoint does a synchronous DB lookup + a write to a 'coupon_attempts' table. A marketing 'flash sale' launched 20 minutes ago. How do you triage and mitigate this L7 attack vs. legitimate flash-sale traffic?