API gateway cascading failures

Design a reverse proxy / API gateway sitting in front of ~300 internal microservices handling 1M req/s. It must pool upstream connections, apply per-route timeouts and retries, and shed load when a downstream is slow without taking down the whole gateway. A single slow dependency currently causes the whole gateway to run out of threads. Explain the architecture and how you prevent one bad backend from cascading.