Distributed rate limiter

Design a distributed rate limiter for a public API gateway with 200 edge nodes across regions enforcing per-API-key quotas (e.g., 1000 requests/minute). Limits must be enforced globally (a key can't get 1000/min per node), the limiter must add <1ms p99, and it must fail open if the limit store is unreachable. Walk through the algorithm, where state lives, and the consistency/latency trade-off.