Add privacy-safe auction-to-creative tracing

[ChristianPavilonis]

Summary

• Add an opt-in, privacy-safe trace console that links Trusted Server auction outcomes to independently observed browser delivery evidence without exposing upstream request IDs, GAM identifiers, targeting, creative content, URLs, consent, or identity data.
• Preserve factual boundaries between Trusted Server selection, Prebid evidence, GAM render classification, iframe load, selected-creative acknowledgement, visibility, and GPT viewability.
• Cover publisher-owned and lazy GPT slots with bounded per-request generations and privacy-safe overlays even when no Trusted Server candidate exists.

Changes

File	Change
crates/trusted-server-core/src/auction/	Generate fresh auction and per-winning-bid trace IDs, retain terminal outcomes, and attach privacy-safe telemetry linkage.
crates/trusted-server-core/src/integrations/ad_trace.rs and adapter middleware	Implement exact console activation, private session handling, response sanitization, and outer-boundary finalization across supported adapters.
crates/trusted-server-js/lib/src/core/ad_trace.ts	Store bounded, monotonic, generation-scoped trace facts without retaining private publisher or ad-platform identifiers.
crates/trusted-server-js/lib/src/integrations/ad_trace/	Render factual console and overlay evidence while hiding unobserved stages and preserving independent evidence semantics.
crates/trusted-server-js/lib/src/integrations/{gpt,prebid}/	Correlate exact slot generations, adopt existing Trusted Server candidates, cover generic GPT lifecycles, bind safe top-document anchors, and fail closed on stale or ambiguous refresh events.
crates/trusted-server-integration-tests/	Add deterministic fixtures and browser coverage for TS winners, publisher-only pages, lazy slots, refreshes, backfill, empty renders, acknowledgement, visibility, viewability, and privacy boundaries.
Configuration, Tinybird, and documentation files	Add opt-in configuration and nullable privacy-safe trace linkage.

Closes

Closes #920

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (503 passed)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Fastly/core, Axum, Cloudflare, Spin, parity, all configured Clippy/WASM gates, and 8 deterministic Playwright ad-trace tests passed. Harness unit tests and focused instrumentation also passed during correlation validation.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses project logging macros (not println!)
• New code has tests
• No secrets or credentials committed

Draft follow-up

• Deploy the branch to the controlled test site and complete the natural initial/lazy/refresh harness acceptance gate.
• Keep generic GPT lifecycle coverage distinct from exact GAM-selected creative attribution; exact attribution remains gated on a controlled Trusted Server Universal Creative selection.