Support analytics adapters in generated Prebid bundles

[ChristianPavilonis]

Summary

• Adds analytics adapter selection to generated Prebid bundles so publisher calls to pbjs.enableAnalytics can use adapters such as ATS without missing-registry errors.
• Replaces the separate bidder and User ID settings with one typed module map covering bidder, User ID, and analytics modules.
• Validates every selected module against the locked Prebid.js package before generating source or invoking Vite, then records module stems and registered runtime codes separately.

Changes

File	Change
crates/trusted-server-cli/src/prebid_bundle.rs	Parses the typed module map, rejects removed fields, sends one JSON request to the generator, and validates the versioned manifest before updating bundle hashes.
crates/trusted-server-js/lib/build-prebid-external.mjs	Validates locked-package metadata and exports, generates selected module imports, and writes nested versioned manifests.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Reads the nested browser manifest and uses registered bidder codes for runtime diagnostics.
crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.json	Keeps User ID registry metadata while removing generator-controlled import paths.
crates/trusted-server-js/lib/src/integrations/prebid/user_id_modules.ts	Removes the obsolete importPath field from the registry type.
crates/trusted-server-js/lib/test/build-prebid-external.test.mjs	Covers request parsing, package validation, metadata and export containment, generated imports, and manifest output.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Covers nested manifest parsing and independent bidder and User ID diagnostics.
crates/trusted-server-js/lib/test/prebid-artifact-integration.test.mjs	Proves ATS registration, publisher queue enablement, auction behavior, network isolation, omitted analytics, and watchdog queue draining with production artifacts.
docs/guide/cli.md	Documents the typed module configuration and generated manifest workflow.
docs/guide/integrations/prebid.md	Documents exact module stems, analytics provider ownership, ATS configuration, and upstream-only restrictions.
docs/superpowers/plans/2026-08-28-prebid-bundle-module-map.md	Records the reviewed implementation and validation plan.
docs/superpowers/specs/2026-08-28-prebid-bundle-module-map-design.md	Records the implemented configuration, validation, manifest, and runtime design.
trusted-server.example.toml	Updates the sample Prebid bundle configuration to use the typed module map.

Scope

This pull request changes the Rust command-line interface, Node.js bundle generator, browser diagnostics, tests, and operator documentation because they share one configuration and manifest contract. It is limited to modules shipped by the locked Prebid.js package. It does not add custom module paths, download third-party adapters, or move pbjs.enableAnalytics options out of publisher code.

Closes

Closes #1085

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, all six target-matched Clippy commands, parity tests, CLI tests, JavaScript build, documentation build, a real bundle smoke test, and the unsupported-module failure path.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code; new fallible paths return actionable errors
• No runtime logging was added; existing project logging conventions are unchanged
• New code has tests
• No secrets or credentials committed