Design a rate-limiting system for an API gateway. How would you test its behavior under high concurrency and distributed load?