feat(router): entity cache OTEL/Prometheus metrics (4/6)

[SkArchon]

Replaces #2952, which was auto-closed as merged when a bad force-push momentarily collapsed the stack branches onto one commit. Same content, same stack position.

Part 4 of 6 — split out from #2777. Stacked on #2945.

What's included

• router/pkg/metric/entity_cache_metrics: cache hit/miss/latency instruments recorded from the per-request cache analytics snapshot
• otel attributes for cache level/source/name/entity type (shared constants so recording sites can't drift)
• entity_caching_stats opt-in config keys for Prometheus and OTLP (yaml + env vars, schema, defaults) — opt-in per feat(router): entity caching with L1/L2, shadow mode, and analytics #2777 review fix: use empty url to use the same url as the playground #21
• graph server wiring: metric setup/shutdown and handler snapshot recording; cache analytics collection enables only when metrics are configured

The tree at this PR's tip is byte-identical to the pre-split router branch — the split is purely for reviewability.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: aa0269a4-4a41-4af5-b646-c9c0b8c844be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Router-nonroot image scan failed

❌ Security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-4d3372feb2a4990d0d2a32e858e75205dc359ca0-nonroot

Please check the security vulnerabilities found in the PR.

If you believe this is a false positive, please add the vulnerability to the .trivyignore file and re-run the scan.

[codecov]

Codecov Report

❌ Patch coverage is 9.59596% with 179 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.31%. Comparing base (6f0c915) to head (181ffd7).

Files with missing lines	Patch %	Lines
router/pkg/metric/entity_cache_metrics.go	0.00%	153 Missing ⚠️
router/core/graph_server.go	12.00%	19 Missing and 3 partials ⚠️
router/core/graphql_handler.go	55.55%	4 Missing ⚠️

Additional details and impacted files

@@                         Coverage Diff                         @@
##           milinda/entity-caching-2-router    #2956      +/-   ##
===================================================================
- Coverage                            57.70%   57.31%   -0.39%     
===================================================================
  Files                                  245      246       +1     
  Lines                                27734    27922     +188     
===================================================================
  Hits                                 16003    16003              
- Misses                               10150    10336     +186     
- Partials                              1581     1583       +2     

Files with missing lines	Coverage Δ
router/core/router.go	66.68% <100.00%> (+0.04%)	⬆️
router/pkg/config/config.go	42.96% <ø> (ø)
router/pkg/metric/config.go	67.50% <ø> (ø)
router/pkg/otel/attributes.go	62.50% <ø> (ø)
router/core/graphql_handler.go	63.14% <55.55%> (-0.28%)	⬇️
router/core/graph_server.go	78.56% <12.00%> (-1.13%)	⬇️
router/pkg/metric/entity_cache_metrics.go	0.00% <0.00%> (ø)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.