Centralize EC middleware finalize lifecycle

[ChristianPavilonis]

Summary

• Centralize EC lifecycle finalization so all routes apply cookie and KV side effects consistently instead of duplicating route-specific behavior.
• Move EC context parsing to router prelude and thread shared context through publisher, integration proxy, and auction paths to enforce Story 5 route semantics.
• Keep /auction read-only for EC generation while preserving consent-gated identity forwarding and documenting that behavior explicitly.

Changes

File	Change
crates/trusted-server-core/src/ec/finalize.rs	Add centralized EC response finalization helpers for cookie set/clear, withdrawal tombstone writes, mismatch reconciliation, and last-seen updates.
crates/trusted-server-core/src/ec/mod.rs	Extend EcContext with pre-read geo support, shared generation API with optional KV write-through, and helper accessors for finalize logic.
crates/trusted-server-adapter-fastly/src/main.rs	Pre-read EcContext/geo/KV in router, pass context through handlers, and apply ec_finalize_response before common response finalization.
crates/trusted-server-core/src/publisher.rs	Remove local EC parsing/mutation and consume router-provided mutable EC context plus optional KV graph.
crates/trusted-server-core/src/integrations/registry.rs	Remove per-route response cookie/header mutation, use shared mutable EC context, and update integration route tests accordingly.
crates/trusted-server-core/src/auction/endpoints.rs	Switch to read-only EC context consumption and document that auction does not generate new EC IDs in Story 5 flow.
docs/guide/configuration.md	Apply Prettier table-spacing normalization required for docs format gate.

Closes

Closes #538

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: N/A

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed