On the subject of rate limiting, what is the best way to apply it across all endpoints, APIs and resources, external and internal, with minimal effort?

Usually, I see this implemented only as an afterthought, and only on endpoints deemed 'dangerous', waiting for a disaster like this to happen...

It's a defense in depth scenario but most webservers have modules for it, Apache certainly does as I've used it not sure about nginx still not used that in production.