fix: recover introspection block across named fragment spreads; dedup cache hash; fix cache Set counter race

- graphql.go: parseGraphQLQuery now indexes top-level FragmentDefinition nodes
  and checkSelections resolves FragmentSpread by name, closing an
  introspection-blocking bypass (`{ ...F }` where F spreads __schema was
  allowed because the spread carried no selection set and definitions loop
  skipped fragments).
- proxy.go/server.go: handleCaching stores the computed cache hash on the
  request context; performProxyRequest reuses it instead of recomputing a
  full MD5 of the request body per proxied request (fallback preserved for
  direct callers).
- cache/memory: Set serializes the exists-check + counter update + store
  with the embedded mutex so concurrent Sets of the same new key can't
  double-increment entryCount/memoryUsage; regression test added.

Verification: go build, go vet, gofmt clean; full go test ./... and
go test -race ./... green (9 packages); golangci-lint 0 issues; trufflehog clean.

cache/memory/memory.go

@@ -158,7 +158,12 @@ func (c *Cache) Set(key string, value []byte, ttl time.Duration) {
 		entry.MemorySize = int64(len(key) + len(entry.Value) + approxEntryOverhead)
 	}
 
-	// Check if this is a new entry or an update
+	// Check if this is a new entry or an update. The exists-check, counter
+	// update and store must be atomic together: without the lock, two
+	// concurrent Sets of the same brand-new key both observe it as absent and
+	// both increment entryCount/memoryUsage, leaving the counters inflated
+	// for a single stored entry.
+	c.Lock()
 	oldEntry, exists := c.entries.Load(key)
 	if exists {
 		// Update memory usage: subtract old entry size, add new entry size
@@ -172,6 +177,7 @@ func (c *Cache) Set(key string, value []byte, ttl time.Duration) {
 	// Add new entry's memory size to total
 	atomic.AddInt64(&c.memoryUsage, entry.MemorySize)
 	c.entries.Store(key, entry)
+	c.Unlock()
 }
 
 func (c *Cache) Get(key string) ([]byte, bool) {