Store request timestamps in a sorted set; prune entries older than the window on each request; count remaining entries.