fix: recover introspection block across named fragment spreads; dedup cache hash; fix cache Set counter race

- graphql.go: parseGraphQLQuery now indexes top-level FragmentDefinition nodes
  and checkSelections resolves FragmentSpread by name, closing an
  introspection-blocking bypass (`{ ...F }` where F spreads __schema was
  allowed because the spread carried no selection set and definitions loop
  skipped fragments).
- proxy.go/server.go: handleCaching stores the computed cache hash on the
  request context; performProxyRequest reuses it instead of recomputing a
  full MD5 of the request body per proxied request (fallback preserved for
  direct callers).
- cache/memory: Set serializes the exists-check + counter update + store
  with the embedded mutex so concurrent Sets of the same new key can't
  double-increment entryCount/memoryUsage; regression test added.

Verification: go build, go vet, gofmt clean; full go test ./... and
go test -race ./... green (9 packages); golangci-lint 0 issues; trufflehog clean.

proxy.go

@@ -370,12 +370,15 @@ func setupTracing(c fiber.Ctx) context.Context {
 
 // performProxyRequest executes the proxy request with retries, circuit breaker, and request coalescing
 func performProxyRequest(c fiber.Ctx, proxyURL string) error {
-	// Extract user context for cache key (needed for coalescing and circuit breaker fallback)
-	userID, userRole := extractUserInfo(c)
-
-	// Calculate cache key - includes user context for security
-	// This key is used for both request coalescing and cache fallback
-	cacheKey := libpack_cache.CalculateHash(c, userID, userRole)
+	// Reuse the cache key already computed by handleCaching (stored on the
+	// request context) to avoid a second MD5 of the full request body per
+	// proxied request. Fall back to computing it when this function is
+	// reached without going through handleCaching (direct callers).
+	cacheKey, _ := c.Locals("query_cache_hash").(string)
+	if cacheKey == "" {
+		userID, userRole := extractUserInfo(c)
+		cacheKey = libpack_cache.CalculateHash(c, userID, userRole)
+	}
 
 	// Check if request coalescing is enabled
 	rc := GetRequestCoalescer()