TokenBucket

A classic token bucket: capacity tokens that refill smoothly over windowMillis.

This is the "max per chunk of time" primitive — a player allowed 60 relocations per minute may burst all 60 at once, then trickles back in at one per second, rather than being hard-cut at a window boundary (which would let a player double their rate by straddling one).

Deliberately clock-injected rather than reading System.currentTimeMillis() internally: tests drive time forward explicitly, so rate behaviour is verified deterministically instead of by sleeping.