Accepted answer
As close to the edge as possible, API gateway or a dedicated middleware layer, using a token bucket per consumer (API key or service identity), so the abusive burst gets rejected before it consumes application or database resources at all.