One GraphQL request costs one rate-limit token however much it asks for #361

Background

Rate limiting counts HTTP requests. A REST caller wanting fifty pairs' prices
makes fifty requests and spends fifty tokens. A GraphQL caller asks for all
fifty in one document — aliasing the same field fifty times is legal GraphQL —
and spends one.

{ a: getPrice(assetA:"XLM", assetB:"USDC") { price }
  b: getPrice(assetA:"XLM", assetB:"USDC") { price }
  … fifty more … }

Each alias runs the resolver, so that is fifty cache reads, fifty aggregate
computations and fifty best-route calculations behind a single token. Depth
limiting (L190) does not help: this query is two levels deep.

What to build

• A query cost or complexity limit, in addition to depth. Assign a cost per
  field — the expensive resolvers are getPrice, getBestRoute and
  getPriceHistory, which hit the database and the cache — and reject a
  document whose total exceeds the budget.
• Or make rate limiting consume tokens proportional to the computed cost, which
  composes better with L188's pricing.
• Either way the limit must be computed from the parsed document before
  execution, not by counting resolver calls as they happen.

Acceptance criteria

• A document's cost is computed before execution
• Repeated aliases of an expensive field increase the cost
• Exceeding the budget is a clear error, not a timeout
• Costs per field are declared in one place and documented
• A test proves fifty aliased getPrice calls do not cost the same as one

Drips Wave · Complexity: Intermediate · 150 points

Repo: Divinity-Labs/Lens. Node + TypeScript, Fastify, mercurius for
GraphQL at POST /graphql, Prisma on Postgres, Redis, Prometheus.

Run the tests: npm test. The tests are vitest, not jest. Running jest
here reports "66 suites, 0 tests" and means nothing. A single file is
npx vitest run src/__tests__/graphqlSubscription.test.ts.

Load test (prices) is already failing on main and has been for some
time. It is not your PR. Everything else should be green.

Read src/__tests__/graphqlSubscription.test.ts before you start. It is the
house pattern for testing this surface and it is good — it drives a real
subscription through a real server and asserts on what a client receives.

This service prices real assets on Stellar mainnet. A wrong number is worse
than a missing one, because the caller cannot tell.

Never elide an address, a contract id or a key in code, comments or test
fixtures. A previous batch shortened a contract id in an issue and five
contributors invented plausible-looking ids to fill the gap. Write it in full or
not at all.

Required: Before submitting, join the contributor Telegram so your work can be tracked and counted toward the Stellar Wave: https://t.me/+fxHXq8f1SwlkZDBk