Make the SSAT debug comment configurable

[prk-Jr]

Summary

• Adds [debug.auction_html_comment_options], making the SSAT <!-- ts-debug: ... --> HTML comment configurable: section toggles (provider responses / mediator response / bids), a metadata-key subset, and an opt-in verbosity = "full" that surfaces raw per-bidder request/response data.
• Answers "why did we get bids for some slots and not others": http_status, upstream_message, and upstream_message_truncated were already captured server-side by the prebid integration but omitted from the allowlist by oversight — now on by default. full verbosity additionally exposes PBS's debug.httpcalls subtree on explicit opt-in, for deep per-bidder request/response debugging.
• The existing fail-closed guarantee is unconditional: metadata_keys is a subset selector against a hardcoded allowlist, never a way to add new keys, and identity-bearing data (device IP, geo, eids, TC consent string) only ever surfaces under the explicit, loudly-documented full opt-in.

Changes

File	Change
crates/trusted-server-core/src/settings.rs	New AuctionDebugCommentOptions struct + AuctionDebugCommentVerbosity enum; AUCTION_DEBUG_METADATA_ALLOWLIST (moved from publisher.rs, expanded with http_status/upstream_message/upstream_message_truncated, dropped unused status); wired into DebugConfig and Settings::finalize_deserialized
crates/trusted-server-core/src/publisher.rs	redact_response_for_dump, redact_bid_for_dump, prepend_auction_debug_comment all take the new options and branch on verbosity; fail-closed allowlist intersection enforced at render time; 12 new tests covering toggles, verbosity, and the metadata-allowlist attack vector
trusted-server.example.toml	Documents [debug.auction_html_comment_options] with the never-production warning for full
docs/superpowers/specs/2026-07-20-ssat-debug-comment-config-design.md	Design spec (3 review rounds, several real bugs caught pre-code)
docs/superpowers/plans/2026-07-20-ssat-debug-comment-config.md	Implementation plan (2 review rounds)

Closes

Closes #935

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum (also ran clippy-cloudflare, clippy-cloudflare-wasm, clippy-spin-native, clippy-spin-wasm — all clean)
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, and cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity — all adapters load Settings from the same TOML shape this PR extends

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!) — N/A, no new logging
• New code has tests
• No secrets or credentials committed