perf+coverage: optimisation pass + coverage push to ≥70%

Performance / resource usage:
- circuit_breaker_metrics: fix data race on failCounters map (RWMutex + double-checked locking)
- server.go: drop user_id and op_name metric labels (Prometheus cardinality bound); de-duplicate extractUserInfo
- graphql.go: gate runtime.ReadMemStats per-request behind ENABLE_ALLOCATION_TRACKING flag (default off)
- graphql.go: collapse two-pass AST scan into single pass; lower-case once
- sanitization.go: cache compiled redaction regexes per pattern via sync.Map; hoist inner constants to pkg vars
- proxy.go: hoist connection/timeout substrings to pkg vars; sentinel errors for static error paths; drop dead Headers map alloc
- metrics_aggregator.go: log-field allocation guarded by Logger.IsLevelEnabled
- logging/logger.go: add IsLevelEnabled helper
- lru_cache.go: 16-shard sharding, FNV-1a routing (concurrent throughput +22%)
- cache/memory/lru_memory_cache.go: gzip compress/decompress moved outside mu.Lock
- rps_tracker.go: RWMutex+uint64 -> atomic.Uint64
- retry_budget.go: drop unused mutex
- api.go: bannedUsersIDs map+RWMutex -> sync.Map (+ snapshot/replace helpers)
- tracing/tracing.go: pkg-level constSpanAttrs, copy-then-append in StartSpanWithAttributes
- admin_dashboard.go: handleStatsWebSocket reuses bytes.Buffer + json.Encoder per connection

Build / runtime:
- Makefile: -ldflags="-s -w" -trimpath, CGO_ENABLED=0 for build (=1 for test recipes)
- Dockerfile + Dockerfile.goreleaser: ENV GOMEMLIMIT=512MiB
- main.go: blank import go.uber.org/automaxprocs (cgroup-aware GOMAXPROCS)
- main.go: PPROF_PORT env var wires net/http/pprof on 127.0.0.1 only with full server timeouts
- README.md: env-var docs + metric-label docs updated; cardinality note

Test coverage push (per package):
- main 51.2% -> 74.7%
- cache 66.3% -> 93.7%
- cache/redis 45.5% -> 98.2%
- tracing 66.7% -> 72.9%
- (cache/memory 91.6%, logging 91.9%, monitoring 77.6%, pkg/pools 100% unchanged)

New test files: coverage_micro_test, coverage_extras_test, server_handlers_test,
api_health_test, admin_dashboard_cluster_test, metrics_aggregator_test, concerns_test,
cache/cache_coverage_test, cache/redis/redis_coverage_test, tracing/tracing_coverage_test.

Bug fix: connection_resilience_test.go TestIntegratedHealthManagement.health_manager_startup
was sync.Once-coupled to InitializeBackendHealth and panicked when another test (e.g. via
parseConfig) had already triggered Once. Use NewBackendHealthManager directly.

api_test.go

@@ -33,7 +33,7 @@ func (suite *Tests) Test_apiBanUser() {
 	// Test valid ban request
 	suite.Run("valid ban request", func() {
 		// Clear banned users map
-		bannedUsersIDs = make(map[string]string)
+		replaceBannedUsers(map[string]string{})
 
 		reqBody := `{"user_id": "test-user-123", "reason": "testing"}`
 		req := httptest.NewRequest(http.MethodPost, "/api/user-ban", bytes.NewBufferString(reqBody))
@@ -48,12 +48,11 @@ func (suite *Tests) Test_apiBanUser() {
 		assert.Contains(suite.T(), string(body), "OK: user banned")
 
 		// Verify user was added to banned users map
-		bannedUsersIDsMutex.RLock()
-		reason, exists := bannedUsersIDs["test-user-123"]
-		bannedUsersIDsMutex.RUnlock()
-
+		v, exists := bannedUsersIDs.Load("test-user-123")
 		assert.True(suite.T(), exists)
-		assert.Equal(suite.T(), "testing", reason)
+		if exists {
+			assert.Equal(suite.T(), "testing", v.(string))
+		}
 
 		// Verify file was created
 		_, err = os.Stat(cfg.Api.BannedUsersFile)
@@ -124,8 +123,7 @@ func (suite *Tests) Test_apiUnbanUser() {
 	// Test valid unban request
 	suite.Run("valid unban request", func() {
 		// Add a user to the banned list
-		bannedUsersIDs = make(map[string]string)
-		bannedUsersIDs["test-user-123"] = "testing"
+		replaceBannedUsers(map[string]string{"test-user-123": "testing"})
 
 		reqBody := `{"user_id": "test-user-123"}`
 		req := httptest.NewRequest(http.MethodPost, "/api/user-unban", bytes.NewBufferString(reqBody))
@@ -140,10 +138,7 @@ func (suite *Tests) Test_apiUnbanUser() {
 		assert.Contains(suite.T(), string(body), "OK: user unbanned")
 
 		// Verify user was removed from banned users map
-		bannedUsersIDsMutex.RLock()
-		_, exists := bannedUsersIDs["test-user-123"]
-		bannedUsersIDsMutex.RUnlock()
-
+		_, exists := bannedUsersIDs.Load("test-user-123")
 		assert.False(suite.T(), exists)
 	})
 
@@ -273,7 +268,7 @@ func (suite *Tests) Test_checkIfUserIsBanned() {
 
 	// Test with non-banned user
 	suite.Run("non-banned user", func() {
-		bannedUsersIDs = make(map[string]string)
+		replaceBannedUsers(map[string]string{})
 
 		isBanned := checkIfUserIsBanned(ctx, "non-banned-user")
 		assert.False(suite.T(), isBanned)
@@ -282,8 +277,7 @@ func (suite *Tests) Test_checkIfUserIsBanned() {
 
 	// Test with banned user
 	suite.Run("banned user", func() {
-		bannedUsersIDs = make(map[string]string)
-		bannedUsersIDs["banned-user"] = "testing"
+		replaceBannedUsers(map[string]string{"banned-user": "testing"})
 
 		isBanned := checkIfUserIsBanned(ctx, "banned-user")
 		assert.True(suite.T(), isBanned)
@@ -303,7 +297,7 @@ func (suite *Tests) Test_loadBannedUsers() {
 		// Remove file if it exists
 		_ = os.Remove(cfg.Api.BannedUsersFile)
 
-		bannedUsersIDs = make(map[string]string)
+		replaceBannedUsers(map[string]string{})
 		loadBannedUsers()
 
 		// Verify file was created
@@ -311,7 +305,7 @@ func (suite *Tests) Test_loadBannedUsers() {
 		assert.NoError(suite.T(), err)
 
 		// Verify banned users map is empty
-		assert.Equal(suite.T(), 0, len(bannedUsersIDs))
+		assert.Equal(suite.T(), 0, len(snapshotBannedUsers()))
 	})
 
 	// Test with existing file
@@ -325,13 +319,14 @@ func (suite *Tests) Test_loadBannedUsers() {
 		err := os.WriteFile(cfg.Api.BannedUsersFile, data, 0o644)
 		assert.NoError(suite.T(), err)
 
-		bannedUsersIDs = make(map[string]string)
+		replaceBannedUsers(map[string]string{})
 		loadBannedUsers()
 
 		// Verify banned users map was loaded
-		assert.Equal(suite.T(), 2, len(bannedUsersIDs))
-		assert.Equal(suite.T(), "reason 1", bannedUsersIDs["test-user-1"])
-		assert.Equal(suite.T(), "reason 2", bannedUsersIDs["test-user-2"])
+		snap := snapshotBannedUsers()
+		assert.Equal(suite.T(), 2, len(snap))
+		assert.Equal(suite.T(), "reason 1", snap["test-user-1"])
+		assert.Equal(suite.T(), "reason 2", snap["test-user-2"])
 	})
 
 	// Test with invalid JSON
@@ -340,11 +335,11 @@ func (suite *Tests) Test_loadBannedUsers() {
 		err := os.WriteFile(cfg.Api.BannedUsersFile, []byte("{invalid json}"), 0o644)
 		assert.NoError(suite.T(), err)
 
-		bannedUsersIDs = make(map[string]string)
+		replaceBannedUsers(map[string]string{})
 		loadBannedUsers()
 
 		// Verify banned users map is empty (load failed)
-		assert.Equal(suite.T(), 0, len(bannedUsersIDs))
+		assert.Equal(suite.T(), 0, len(snapshotBannedUsers()))
 	})
 
 	// Cleanup
@@ -362,10 +357,10 @@ func (suite *Tests) Test_storeBannedUsers() {
 	// Test storing banned users
 	suite.Run("store banned users", func() {
 		// Set up test data
-		bannedUsersIDs = map[string]string{
+		replaceBannedUsers(map[string]string{
 			"test-user-1": "reason 1",
 			"test-user-2": "reason 2",
-		}
+		})
 
 		err := storeBannedUsers()
 		assert.NoError(suite.T(), err)