Add authenticated S2S batch sync endpoint

[ChristianPavilonis]

Summary

• Add POST /api/v1/sync S2S batch sync endpoint with Bearer-token partner auth, per-partner rate limiting, request validation, per-mapping processing, and 200/207 response behavior.
• Add KV write path upsert_partner_id_if_exists returning explicit outcomes (Written, NotFound, ConsentWithdrawn, Stale) so batch sync can reject unknown hashes, block withdrawn consent, and treat stale timestamps as accepted no-ops.
• Reuse sync rate-limit primitives by exposing RateLimiter/FastlyRateLimiter and route S2S sync in the adapter with direct return (skipping EC cookie finalize middleware for non-browser traffic).

Details

• New module: crates/trusted-server-core/src/ec/batch_sync.rs
  • Parses Authorization: Bearer <token>
  • Authenticates via PartnerStore::find_by_api_key_hash(hash_api_key(token))
  • Enforces per-partner rate limit using partner.batch_rate_limit
  • Validates max batch size (1000), hash format, non-empty partner_uid, required timestamp
  • Normalizes incoming ssc_hash to lowercase before KV lookup
  • Returns JSON summary { accepted, rejected, errors[] }
• KV updates: crates/trusted-server-core/src/ec/kv.rs
  • UpsertResult enum
  • upsert_partner_id_if_exists(...) CAS write without auto-create
• Adapter route: crates/trusted-server-adapter-fastly/src/main.rs
  • Wires POST /api/v1/sync
  • Skips ec_finalize_response for this S2S endpoint

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace (798 tests)
• cd crates/js/lib && npx vitest run (282 tests)

Closes

• S2S batch sync (POST /api/v1/sync) #541