perf+coverage: optimisation pass + coverage push to ≥70%

Performance / resource usage:
- circuit_breaker_metrics: fix data race on failCounters map (RWMutex + double-checked locking)
- server.go: drop user_id and op_name metric labels (Prometheus cardinality bound); de-duplicate extractUserInfo
- graphql.go: gate runtime.ReadMemStats per-request behind ENABLE_ALLOCATION_TRACKING flag (default off)
- graphql.go: collapse two-pass AST scan into single pass; lower-case once
- sanitization.go: cache compiled redaction regexes per pattern via sync.Map; hoist inner constants to pkg vars
- proxy.go: hoist connection/timeout substrings to pkg vars; sentinel errors for static error paths; drop dead Headers map alloc
- metrics_aggregator.go: log-field allocation guarded by Logger.IsLevelEnabled
- logging/logger.go: add IsLevelEnabled helper
- lru_cache.go: 16-shard sharding, FNV-1a routing (concurrent throughput +22%)
- cache/memory/lru_memory_cache.go: gzip compress/decompress moved outside mu.Lock
- rps_tracker.go: RWMutex+uint64 -> atomic.Uint64
- retry_budget.go: drop unused mutex
- api.go: bannedUsersIDs map+RWMutex -> sync.Map (+ snapshot/replace helpers)
- tracing/tracing.go: pkg-level constSpanAttrs, copy-then-append in StartSpanWithAttributes
- admin_dashboard.go: handleStatsWebSocket reuses bytes.Buffer + json.Encoder per connection

Build / runtime:
- Makefile: -ldflags="-s -w" -trimpath, CGO_ENABLED=0 for build (=1 for test recipes)
- Dockerfile + Dockerfile.goreleaser: ENV GOMEMLIMIT=512MiB
- main.go: blank import go.uber.org/automaxprocs (cgroup-aware GOMAXPROCS)
- main.go: PPROF_PORT env var wires net/http/pprof on 127.0.0.1 only with full server timeouts
- README.md: env-var docs + metric-label docs updated; cardinality note

Test coverage push (per package):
- main 51.2% -> 74.7%
- cache 66.3% -> 93.7%
- cache/redis 45.5% -> 98.2%
- tracing 66.7% -> 72.9%
- (cache/memory 91.6%, logging 91.9%, monitoring 77.6%, pkg/pools 100% unchanged)

New test files: coverage_micro_test, coverage_extras_test, server_handlers_test,
api_health_test, admin_dashboard_cluster_test, metrics_aggregator_test, concerns_test,
cache/cache_coverage_test, cache/redis/redis_coverage_test, tracing/tracing_coverage_test.

Bug fix: connection_resilience_test.go TestIntegratedHealthManagement.health_manager_startup
was sync.Once-coupled to InitializeBackendHealth and panicked when another test (e.g. via
parseConfig) had already triggered Once. Use NewBackendHealthManager directly.

graphql.go

@@ -227,9 +227,10 @@ func trackParsingAllocations() func() {
 func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 	startTime := time.Now()
 
-	// Set up allocation tracking
-	trackAllocs := trackParsingAllocations()
-	defer trackAllocs()
+	if cfg != nil && cfg.EnableAllocationTracking {
+		trackAllocs := trackParsingAllocations()
+		defer trackAllocs()
+	}
 
 	// Get a result object from the pool and initialize it
 	res := resultPool.Get().(*parseGraphQLQueryResult)
@@ -321,68 +322,56 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 	res.shouldIgnore = false
 	res.operationName = "undefined"
 
-	// First scan for mutations - they take priority
+	// Single pass over definitions: gather operation type, mutation flag,
+	// operation name, and process directives / introspection checks together.
+	// Mutations take priority for operationType regardless of order.
 	hasMutation := false
-	var mutationName string
 
 	for _, d := range p.Definitions {
-		if oper, ok := d.(*ast.OperationDefinition); ok {
-			operationType := strings.ToLower(oper.Operation)
-			if operationType == "mutation" {
-				hasMutation = true
-				res.operationType = "mutation"
-				if oper.Name != nil {
-					mutationName = oper.Name.Value
-					// Use mutation name immediately, sanitized to prevent metric panics
-					res.operationName = sanitizeOperationName(mutationName)
-				}
-				break // Found a mutation, no need to continue first pass
-			}
+		oper, ok := d.(*ast.OperationDefinition)
+		if !ok {
+			continue
 		}
-	}
 
-	// Now process all definitions for other information
-	for _, d := range p.Definitions {
-		if oper, ok := d.(*ast.OperationDefinition); ok {
-			operationType := strings.ToLower(oper.Operation)
+		// Lower-case operation string ONCE per definition.
+		operationType := strings.ToLower(oper.Operation)
+		isMutation := operationType == "mutation"
 
-			// If we already found a mutation, only update name if needed
-			if hasMutation {
-				// We already set operation type to mutation in first pass
-				// Only set name if we didn't find a mutation name earlier
-				if res.operationName == "undefined" && oper.Name != nil {
-					res.operationName = sanitizeOperationName(oper.Name.Value)
-				}
-			} else {
-				// No mutation found, use the normal logic
-				if res.operationType == "" {
-					res.operationType = operationType
-				}
-
-				if res.operationName == "undefined" && oper.Name != nil {
-					res.operationName = sanitizeOperationName(oper.Name.Value)
-				}
+		// Operation type assignment: mutations take priority; otherwise first-seen wins.
+		if isMutation && !hasMutation {
+			hasMutation = true
+			res.operationType = "mutation"
+			// Mutation name takes precedence — overwrite "undefined" if present.
+			if oper.Name != nil {
+				res.operationName = sanitizeOperationName(oper.Name.Value)
 			}
+		} else if !hasMutation && res.operationType == "" {
+			res.operationType = operationType
+		}
 
-			// Block mutations in read-only mode
-			if res.operationType == "mutation" && cfg.Server.ReadOnlyMode {
-				if ifNotInTest() {
-					cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
-				}
-				_ = c.Status(403).SendString("The server is in read-only mode")
-				res.shouldBlock = true
-				return res
+		// Operation name fill-in for non-mutation cases (or mutation w/o name handled above).
+		if res.operationName == "undefined" && oper.Name != nil {
+			res.operationName = sanitizeOperationName(oper.Name.Value)
+		}
+
+		// Block mutations in read-only mode
+		if res.operationType == "mutation" && cfg.Server.ReadOnlyMode {
+			if ifNotInTest() {
+				cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 			}
+			_ = c.Status(403).SendString("The server is in read-only mode")
+			res.shouldBlock = true
+			return res
+		}
 
-			// Process directives (like @cached)
-			processDirectives(oper, res)
+		// Process directives (like @cached)
+		processDirectives(oper, res)
 
-			// Check for introspection queries if they're blocked
-			if cfg.Security.BlockIntrospection && checkSelections(c, oper.GetSelectionSet().Selections) {
-				_ = c.Status(403).SendString("Introspection queries are not allowed")
-				res.shouldBlock = true
-				return res
-			}
+		// Check for introspection queries if they're blocked
+		if cfg.Security.BlockIntrospection && checkSelections(c, oper.GetSelectionSet().Selections) {
+			_ = c.Status(403).SendString("Introspection queries are not allowed")
+			res.shouldBlock = true
+			return res
 		}
 	}