Add managed LiveRamp RampID integration

[prk-Jr]

Summary

• Add managed LiveRamp RampID support to the Prebid integration so operators can configure IdentityLink once at the server layer without page code overriding the managed entry.
• Preserve existing user-ID modules while carrying opaque liveramp.com EIDs through auction, consent, deduplication, edge-cookie, and key-value flows.
• Document the integration boundary: RampID identity envelopes are supported; ATS Direct audience segments are outside this implementation. Live validation remains pending Get test credentials from LR team uid2-optout#385.

Changes

File	Change
crates/trusted-server-core/src/auction/endpoints.rs	Add regression coverage for LiveRamp EID metadata and deduplication in auction requests.
crates/trusted-server-core/src/consent/mod.rs	Cover LiveRamp EID removal when Purpose 4 consent is denied.
crates/trusted-server-core/src/ec/prebid_eids.rs	Verify opaque LiveRamp identity envelopes survive edge-cookie persistence.
crates/trusted-server-core/src/integrations/prebid.rs	Add typed LiveRamp configuration, validation, defaults, Prebid injection, and unit tests.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Install managed IdentityLink configuration and guard the public setConfig and mergeConfig APIs while preserving other ID modules.
crates/trusted-server-js/lib/test/build-prebid-external.test.mjs	Require the LiveRamp IdentityLink module in generated external Prebid bundles.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Cover configuration ownership, queued and late API calls, transport behavior, privacy handling, and idempotence.
crates/trusted-server-js/lib/test/integrations/prebid/user_id_modules.test.ts	Cover LiveRamp user-ID mapping and default preset behavior.
crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs	Exercise the real generated Prebid artifact, including the public mergeConfig path and auction EID output.
docs/guide/configuration.md	Add the LiveRamp configuration reference and validation rules.
docs/guide/integrations/prebid.md	Document operator setup, identity flow, ownership limits, privacy behavior, failure modes, and live-validation steps.
docs/superpowers/plans/2026-08-21-liveramp-integration.md	Record the reviewed implementation and regression plan.
docs/superpowers/specs/2026-08-21-liveramp-integration-design.md	Specify the LiveRamp integration architecture, requirements, and scope.
trusted-server.example.toml	Add an example managed LiveRamp configuration.

Closes

Closes #355

Test plan

• cargo test-fastly && cargo test-axum && cargo test-cloudflare
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
• cargo fmt --all -- --check
• cd crates/trusted-server-js/lib && npx vitest run
• cd crates/trusted-server-js/lib && npm run format
• cd docs && npm run format
• Production WASM release build
• Manual Fastly/Viceroy smoke test
• Other: real generated Prebid artifact integration tests ran as part of Vitest.

Hardening note

Not applicable. This change does not introduce config-derived regular-expression or pattern compilation. Invalid enabled LiveRamp configuration is rejected by typed validation and covered by Rust regression tests.

Checklist

• Code follows the conventions in CLAUDE.md.
• No new unwrap() calls were introduced in production code.
• No direct console or stdout logging was introduced.
• New behavior is covered by automated tests.
• No secrets or live LiveRamp credentials are included.