[dhruv8sh]

Summary

• Adds a server-side identity provider framework so Trusted Server can collect provider EIDs (extended IDs) on publisher navigations instead of depending only on browser-side ID modules, which ad blockers and browser privacy features increasingly strip.
• Stores provider EIDs at full fidelity (source, all UIDs, atype, ext) and serves them unchanged into OpenRTB and Prebid, so bidders see the same shape the provider returned.
• Collapses every browser-driven Edge Cookie KV write into a single page-load write, so provider lookups, partner syncs and consent changes share one write per navigation and stay inside the KV write budget.

This is the core of the work. Follow-up PRs stack on this branch: mirror/pull sync, then the per-vendor provider implementations.

Changes

The original three units:

Area	Change
ec/eid_types.rs, ec/kv_types.rs, ec/kv.rs, ec/eids.rs, openrtb.rs, ec/prebid_eids.rs	Full-fidelity provider EID storage and serving
ec/write_plan.rs, ec/page_load.rs, ec/finalize.rs, publisher.rs	One page-load write per browser navigation, built from a write plan
ec/provider.rs, ec/coordinator/*, ec/registry.rs, settings.rs, config.rs, new trusted-server-identity-providers crate, adapter app.rs / main.rs	Provider config, validation and a coordinator that runs provider lookups concurrently on publisher navigations within the request deadline
docs/guide/configuration.md, trusted-server.example.toml	ec.identity_providers configuration docs and example

Follow-up fixes on top:

• Fix provider ownership, orphan attribution and size cap issues.
• Skip partner token length checks in deploy-time provider validation (tokens are still secret key names at deploy time).
• Stop warning about unregistered provider kinds where kinds are unknown.
• Write orphan-recovery lookups to the replacement EC row.
• Keep responses whose headers arrive, and surface arrived bodies once, in an expired deadline snapshot (platform/deadline.rs, auction/endpoints.rs).
• Fall back to browser IDs for provider-owned sources the provider did not return.

Closes

Part of #1246 and #1245; the provider implementations that close them come in follow-up PRs.

Spec

Spec: reviewed separately; not included in this PR.

Test plan

• cargo test-fastly && cargo test-fastly-reuse && cargo test-axum && cargo test-cloudflare && cargo test-spin
• All eight clippy aliases (clippy-fastly, -axum, -cloudflare, -cloudflare-wasm, -spin-native, -spin-wasm, -cli, -codegen)
• cargo fmt --all -- --check
• Parity tests, native template build-digest test and clippy, scripts/lint-wasm-clock.sh
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (plus npm run format and npm run lint)
• Docs format and Markdown prettier check
• ./scripts/test-cli.sh, domain lint against origin/main, CI Node pin guard
• Manual testing via fastly compute serve

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed

[jwrosewell]

@dhruv8sh, directionally the layout here is not compatible with V2 (the 55 pull requests tracked in #777, merged in order).

This pull request creates one shared trusted-server-identity-providers crate, and #1488 adds eight vendors to it as files. In V2 each identity vendor is a module in a folder of its own at identity/<vendor>, where Lockr already is, with its own named maintainer. A module hands core the identifiers it learned for a request, and the Edge Cookie itself is a module.

The V2 spec is identifier-modules and pluggable-providers, with the folder layout in integrations-crate, all in #1342. The associated pull requests are #1382 (a module hands core its identifiers, starting with the Prebid EID cookie) and #1343 (the Edge Cookie as a module, with the HMAC module built in).

Could you evaluate the V2 spec and those pull requests before progressing this one?