perf+coverage: optimisation pass + coverage push to ≥70%

Performance / resource usage:
- circuit_breaker_metrics: fix data race on failCounters map (RWMutex + double-checked locking)
- server.go: drop user_id and op_name metric labels (Prometheus cardinality bound); de-duplicate extractUserInfo
- graphql.go: gate runtime.ReadMemStats per-request behind ENABLE_ALLOCATION_TRACKING flag (default off)
- graphql.go: collapse two-pass AST scan into single pass; lower-case once
- sanitization.go: cache compiled redaction regexes per pattern via sync.Map; hoist inner constants to pkg vars
- proxy.go: hoist connection/timeout substrings to pkg vars; sentinel errors for static error paths; drop dead Headers map alloc
- metrics_aggregator.go: log-field allocation guarded by Logger.IsLevelEnabled
- logging/logger.go: add IsLevelEnabled helper
- lru_cache.go: 16-shard sharding, FNV-1a routing (concurrent throughput +22%)
- cache/memory/lru_memory_cache.go: gzip compress/decompress moved outside mu.Lock
- rps_tracker.go: RWMutex+uint64 -> atomic.Uint64
- retry_budget.go: drop unused mutex
- api.go: bannedUsersIDs map+RWMutex -> sync.Map (+ snapshot/replace helpers)
- tracing/tracing.go: pkg-level constSpanAttrs, copy-then-append in StartSpanWithAttributes
- admin_dashboard.go: handleStatsWebSocket reuses bytes.Buffer + json.Encoder per connection

Build / runtime:
- Makefile: -ldflags="-s -w" -trimpath, CGO_ENABLED=0 for build (=1 for test recipes)
- Dockerfile + Dockerfile.goreleaser: ENV GOMEMLIMIT=512MiB
- main.go: blank import go.uber.org/automaxprocs (cgroup-aware GOMAXPROCS)
- main.go: PPROF_PORT env var wires net/http/pprof on 127.0.0.1 only with full server timeouts
- README.md: env-var docs + metric-label docs updated; cardinality note

Test coverage push (per package):
- main 51.2% -> 74.7%
- cache 66.3% -> 93.7%
- cache/redis 45.5% -> 98.2%
- tracing 66.7% -> 72.9%
- (cache/memory 91.6%, logging 91.9%, monitoring 77.6%, pkg/pools 100% unchanged)

New test files: coverage_micro_test, coverage_extras_test, server_handlers_test,
api_health_test, admin_dashboard_cluster_test, metrics_aggregator_test, concerns_test,
cache/cache_coverage_test, cache/redis/redis_coverage_test, tracing/tracing_coverage_test.

Bug fix: connection_resilience_test.go TestIntegratedHealthManagement.health_manager_startup
was sync.Once-coupled to InitializeBackendHealth and panicked when another test (e.g. via
parseConfig) had already triggered Once. Use NewBackendHealthManager directly.

main.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"net/http"
 	"net/url"
 	"os"
 	"os/signal"
@@ -15,6 +16,10 @@ import (
 	"syscall"
 	"time"
 
+	// Register pprof handlers on http.DefaultServeMux. Listener is bound to
+	// 127.0.0.1 only and gated by PPROF_PORT — never expose publicly.
+	_ "net/http/pprof" //nolint:gosec // G108: handlers gated by PPROF_PORT, bound to 127.0.0.1 only
+
 	"github.com/gofiber/fiber/v2/middleware/proxy"
 	"github.com/gookit/goutil/envutil"
 	graphql "github.com/lukaszraczylo/go-simple-graphql"
@@ -23,6 +28,9 @@ import (
 	libpack_logging "github.com/lukaszraczylo/graphql-monitoring-proxy/logging"
 	libpack_monitoring "github.com/lukaszraczylo/graphql-monitoring-proxy/monitoring"
 	libpack_tracing "github.com/lukaszraczylo/graphql-monitoring-proxy/tracing"
+
+	// Auto-tune GOMAXPROCS from cgroup CPU quota (containerized workloads).
+	_ "go.uber.org/automaxprocs"
 )
 
 var (
@@ -170,6 +178,7 @@ func parseConfig() {
 		return strings.Split(urls, ",")
 	}()
 	c.LogLevel = strings.ToUpper(getDetailsFromEnv("LOG_LEVEL", "info"))
+	c.EnableAllocationTracking = getDetailsFromEnv("ENABLE_ALLOCATION_TRACKING", false)
 	// Logger setup
 	c.Logger = libpack_logging.New().SetMinLogLevel(libpack_logging.GetLogLevel(c.LogLevel)).
 		SetFieldName("timestamp", "ts").SetFieldName("message", "msg").SetShowCaller(false)
@@ -310,6 +319,39 @@ func parseConfig() {
 	// Admin dashboard configuration
 	c.AdminDashboard.Enable = getDetailsFromEnv("ADMIN_DASHBOARD_ENABLE", true)
 
+	// Optional debug pprof endpoint. Disabled unless PPROF_PORT is set to a
+	// valid integer. Bound to 127.0.0.1 ONLY — pprof must never be exposed
+	// publicly (it leaks memory layout, allows arbitrary CPU profiles, etc).
+	if pprofPortStr := getDetailsFromEnv("PPROF_PORT", ""); pprofPortStr != "" {
+		if pprofPort, err := strconv.Atoi(pprofPortStr); err == nil && pprofPort > 0 && pprofPort < 65536 {
+			addr := "127.0.0.1:" + strconv.Itoa(pprofPort)
+			c.Logger.Info(&libpack_logging.LogMessage{
+				Message: "pprof endpoint listening on " + addr,
+			})
+			go func(listenAddr string) {
+				srv := &http.Server{
+					Addr:              listenAddr,
+					Handler:           nil,
+					ReadHeaderTimeout: 5 * time.Second,
+					ReadTimeout:       30 * time.Second,
+					WriteTimeout:      120 * time.Second,
+					IdleTimeout:       120 * time.Second,
+				}
+				if err := srv.ListenAndServe(); err != nil {
+					c.Logger.Error(&libpack_logging.LogMessage{
+						Message: "pprof endpoint failed",
+						Pairs:   map[string]any{"error": err.Error(), "addr": listenAddr},
+					})
+				}
+			}(addr)
+		} else {
+			c.Logger.Warning(&libpack_logging.LogMessage{
+				Message: "PPROF_PORT set but invalid; pprof endpoint disabled",
+				Pairs:   map[string]any{"value": pprofPortStr},
+			})
+		}
+	}
+
 	cfgMutex.Lock()
 	cfg = &c
 	cfgMutex.Unlock()