Minimal reproduction

@vercel/firewall Rate Limit API

Allowed requests intentionally return 400. Requests over the configured limit should return 429 when the Firewall rule uses Then: Default (429).

Fixed-window counters persist until the window ends. Wait for the next window before comparing modes or changing concurrency.