Your company hosts a global e-commerce web application. You must deliver it through Azure Front Door with the following requirements: a managed Web Application Firewall (WAF) with bot protection managed rule sets, private connectivity to origins hosted on Azure App Service using Private Link, and custom rules-engine actions to rewrite request URLs. You want to minimize cost while still meeting every requirement. Which Azure Front Door tier should you deploy?