Pull sync dispatch

[aram356]

Parent epic

#532

Description

Implement the background pull sync dispatcher that calls partner resolution endpoints after the response is flushed via send_to_client(). Uses send_async() + PendingRequest::wait() (synchronous blocking, no async runtime). Only fires on organic routes.

Scope: ec/pull_sync.rs

Acceptance criteria

• Dispatch only on organic routes (handle_publisher_request, handle_proxy) — never on /sync, /identify, /auction, /api/v1/sync, /admin/*.
• Dispatch when: EC present, consent granted, pull_sync_enabled = true, and either no existing partner entry or synced older than pull_sync_ttl_sec.
• Rate limit: pull:{partner_id}:{ec_hash}, 1-hour window.
• Max concurrent pulls: settings.ec.pull_sync_concurrency (default 3).
• Validate pull_sync_url hostname in pull_sync_allowed_domains; skip and log error if not.
• Outbound: GET {pull_sync_url}?ec_hash={hash}&ip={ip} with Authorization: Bearer {ts_pull_token}.
• { "uid": null } and 404 → no-op, no error above debug.
• Non-200 → no retry, no error above warn.
• Runs after send_to_client() — no user-facing latency. Uses send_async() + PendingRequest::wait() (blocking).
• Unit tests cover trigger conditions, null/404 no-op, domain allowlist, dispatch limit.

Spec ref

docs/internal/ssc_technical_spec.md §10