Put a hard spending limit on my AI feature

My <stack> app on <host> calls <model> from a page anyone can reach.

Add limits, using storage this host already gives me:
- A per-visitor rate limit, tied to something harder to fake than a cookie.
- A daily spending cap across all visitors that stops serving when it's
  reached. It must fail closed, not open.
- An alert to me at half the cap.
- A friendly message when either limit is hit.
- Counters that stay correct when two requests arrive at the same moment.

Tell me what happens today if someone scripts the page.