Add TS admin endpoint to look up EC by id

[prk-Jr]

Summary

• Adds GET /_ts/admin/ec/{id} (explicit EC ID) and GET /_ts/admin/ec (EC ID from the caller's ts-ec cookie) so operators can inspect EC identity graph entries without KV console access.
• The EC response includes a derived auction view: the exact EIDs the auction would attach for the entry, plus the reason each stored partner ID was skipped (empty_uid, not_in_registry, bidstream_disabled) — making KV-to-auction EID propagation debuggable in one call. Corrupt or legacy-schema entries stay inspectable via a new raw lookup that reports entry_error + raw_body instead of failing closed.
• Adds GET /_ts/admin/eids, the client-side half of the picture: it echoes the request's ts-eids and sharedId cookies and previews what cookie ingestion would write into the EC entry's ids map (matched partner UIDs, deduplicated exactly like the ingestion path, plus dropped sources). Pure request inspection with no KV access, so every adapter serves the real handler; always responds 200.

Changes

File	Change
crates/trusted-server-core/src/ec/admin.rs	New handle_admin_ec_lookup + handle_admin_eids_lookup handlers, response payload types, 14 unit tests
crates/trusted-server-core/src/ec/kv.rs	New KvIdentityGraph::lookup_raw returning raw body/metadata/generation without validation
crates/trusted-server-core/src/ec/prebid_eids.rs	Expose cookie-ingestion collectors pub(crate) so the EIDs preview reuses them instead of reimplementing
crates/trusted-server-core/src/ec/mod.rs	Register admin module
crates/trusted-server-core/src/settings.rs	Add all three routes to Settings::ADMIN_ENDPOINTS; update coverage tests
crates/trusted-server-adapter-fastly/src/app.rs	Route EC + EIDs paths to the real handlers; route-table tests. The EC arm deliberately builds its own identity graph instead of reusing the bot-gated ec.kv_graph, so operator curl requests work
crates/trusted-server-adapter-axum/src/app.rs	EC routes → local 501 (AdminEcNotSupported); EIDs route → real handler
crates/trusted-server-adapter-axum/tests/routes.rs	Route-registration, authenticated-501 (EC) and authenticated-200 (EIDs) tests
crates/trusted-server-adapter-cloudflare/src/app.rs	EC routes → local 501; EIDs route → real handler
crates/trusted-server-adapter-cloudflare/tests/routes.rs	Route-registration, authenticated-501 (EC) and authenticated-200 (EIDs) tests
crates/trusted-server-adapter-spin/src/app.rs	EC routes → local 501; EIDs route → real handler; extend fallback-methods table
crates/trusted-server-adapter-spin/tests/routes.rs	Authenticated-501 (EC) and authenticated-200 (EIDs) tests

Closes

Closes #921

Test plan

• cargo test-fastly && cargo test-axum (also cargo test-cloudflare && cargo test-spin)
• cargo clippy-fastly && cargo clippy-axum (also clippy-cloudflare, clippy-cloudflare-wasm, clippy-spin-native, clippy-spin-wasm)
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (JS untouched — left to CI)
• JS format: cd crates/trusted-server-js/lib && npm run format (JS untouched — left to CI)
• Docs format: cd docs && npm run format (docs untouched — left to CI)
• WASM build: cargo check -p trusted-server-adapter-fastly --target wasm32-wasip1
• Manual testing via fastly compute serve: verified auth gating, the EC lookup against the seeded Viceroy entry, and the EIDs echo against real browser cookies; this surfaced (and the branch fixes) an initial bug where the bot-gated KV graph made curl requests return 501
• Other: integration parity suite (cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity)

Hardening note

All three paths were added to Settings::ADMIN_ENDPOINTS, so startup validation fails closed (a Configuration error via Report, no panic!/unwrap()/expect()) for any config whose basic-auth handler regex does not cover them; prefix-style regexes like the example config's ^/_ts/admin remain valid. Covered by the updated uncovered_admin_endpoints_* and admin_endpoints_match_fastly_router tests. Routes are registered explicitly on every adapter so they never fall through to the publisher fallback, which would forward the caller's Authorization header to the origin.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed