Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?

Do it like plane tickets do, tie a ticket to an identity + buyback up to a week or so before the concert in case someone wants to cancel (or authorize the transfer and capture only a week before). Ask for ID and ticket at the entrance.

Sell them via a Dutch auction. Eliminate the arbitrage opportunity for scalpers and make more money in the process.

I'd simply check filling speed, even with browser's autocomplete humans are slow due needing click submit.

Then when it's "processing", do them in bulk and prioritize slower users. There's huge opportunity do bot checks after checkout without affecting user experience.

Also on product launches you could add unique field which requires user to input, for example that way bots can't prepare for launches.

Tie them to the buyer's identity, offer at-value buy-backs until X weeks before event, disallow resale.