Implement a thread-safe rate limiter

Design and implement a per-user API rate limiter. Requirements: - Method: `boolean allow(String userId, long nowMillis)` returns whether the request is allowed at time `nowMillis`. - Policy: allow at most **N** requests per **W** milliseconds per user. - Choose any standard algorithm (e.g., fixed window, sliding window, token bucket). Follow-ups: - How do you make it safe under concurrency (multiple threads calling `allow` for the same `userId`)? - Discuss tradeoffs between using locks vs lock-free/low-lock approaches (e.g., `ConcurrentHashMap`, atomics) and performance implications.