Decorate auction bidstream with partner EIDs from KV identity graph

[ChristianPavilonis]

Summary

• Resolve partner EIDs from the KV identity graph during /auction and attach them to outbound OpenRTB bid requests (user.ext.eids) with TCF Purpose 1+4 consent gating via gate_eids_by_consent.
• Add x-ts-ec-consent, x-ts-eids, and x-ts-eids-truncated response headers on auction responses, with consent signaled independently of EID presence so clients can distinguish "consent verified, no syncs yet" from "consent denied".
• Extract shared EID resolution helpers (resolve_partner_ids, to_eids, build_eids_header, encode_eids_header) from identify.rs into a new ec::eids module reused by both /identify and /auction.

Changes

• ec/eids.rs (new) — shared EID resolution, OpenRTB conversion, and base64 header encoding with 4KB truncation
• auction/endpoints.rs — handle_auction reads KV, resolves partner IDs, consent-gates EIDs; graceful degradation on KV/partner errors (empty EIDs, auction proceeds)
• auction/formats.rs — convert_to_openrtb_response emits x-ts-ec-consent: ok based on consent state, x-ts-eids + truncation header based on EID presence
• auction/types.rs — UserInfo.eids: Option<Vec<Eid>> field (#[serde(skip)])
• integrations/prebid.rs — user.ext.eids populated from request.user.eids (already consent-gated)
• adapter main.rs — passes PartnerStore to /auction route (optional, graceful if absent)
• openrtb.rs — Clone derive on Eid and Uid
• ec/identify.rs — refactored to import from ec::eids (net -78 lines)
• consent/mod.rs — updated gate_eids_by_consent doc comment (no longer "not yet wired")

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace (787 tests)
• cd crates/js/lib && npx vitest run (282 tests)
• cd crates/js/lib && npm run format
• cd docs && npx prettier --check .

Closes

• Auction bidstream decoration #543