Spec: auction provider refactor

[ChristianPavilonis]

Summary

• Defines a configuration-driven architecture for registering OpenRTB 2.6 auction providers without adding a new provider implementation for every standards-compliant endpoint.
• Separates common routing, transport, signing, and OpenRTB behavior from typed Prebid Server and Amazon Publisher Services profiles while preserving current auction behavior.
• Documents the startup validation, runtime flow, failure handling, security boundaries, and acceptance criteria needed before implementation begins.

The current architecture combines provider identity, routing, request construction, transport, and response interpretation inside static Prebid Server and Amazon Publisher Services implementations. This design establishes clear ownership boundaries and a central bidder-to-provider routing model so future implementation work can proceed against an agreed contract.

Closes #1026

Changes

File	Change
docs/superpowers/specs/2026-08-10-config-first-auction-provider-architecture-design.md	Adds the approved design for configuration-defined OpenRTB providers, profile registration, bidder routing, behavior parity, validation, and runtime execution.

Scope

This is intentionally a documentation-only pull request. It records the complete architecture decision in one design document because provider configuration, routing, profile ownership, and compatibility requirements must be reviewed together. It does not change runtime code, configuration parsing, or auction behavior; implementation will follow separately.

Closes

No linked issue. This pull request records the approved architecture before implementation work begins.

Test plan

• cargo test-fastly && cargo test-axum — not applicable; no Rust changes
• cargo clippy-fastly && cargo clippy-axum — not applicable; no Rust changes
• cargo fmt --all -- --check — not applicable; no Rust changes
• JS tests: cd crates/trusted-server-js/lib && npx vitest run — not applicable; no JavaScript changes
• JS format: cd crates/trusted-server-js/lib && npm run format — not applicable; no JavaScript changes
• Docs format: cd docs && npm run format — local dependencies are not installed
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1 — not applicable; no runtime changes
• Manual testing via fastly compute serve — not applicable; no runtime changes
• Other: cd docs && npx --yes prettier@3.4.2 --check superpowers/specs/2026-08-10-config-first-auction-provider-architecture-design.md

Checklist

• Changes follow CLAUDE.md conventions
• No production code was changed
• No secrets or credentials committed
• The design links only to existing repository documents