Exclude GAM paths from Prebid refresh auctions

[ChristianPavilonis]

Summary

• Add an operator-configured GAM ad-unit-path suffix opt-out for Trusted Server Prebid refresh auctions.
• Preserve GAM refreshes and normal-slot auctions, including mixed global refreshes.
• Document matching, validation, and external-bundle rollout requirements.

Changes

File	Change
crates/trusted-server-core/src/integrations/prebid.rs	Add validated, deduplicated suffix config and inject it into the managed Prebid browser config.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Exclude matching GPT paths from synthetic refresh ad units while retaining their GPT refresh.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Cover explicit, all-excluded, mixed, fail-open, and literal matching behavior.
docs/guide/integrations/prebid.md	Document configuration semantics and deployment requirements.
trusted-server.example.toml	Add a commented configuration example.
docs/superpowers/{specs,plans}/2026-07-24-prebid-refresh-gam-path-opt-out*	Add the approved design and implementation plan.

Closes

Closes #964

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Cloudflare and Spin tests; all configured clippy targets; integration parity tests; supported external Prebid bundle build to /tmp/trusted-server-prebid-refresh-path-opt-out.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• No new logging was required; no println! was added
• New code has tests
• No secrets or credentials committed

[prk-Jr]

Summary

The refresh-path exclusion behavior, validation, injection, and test coverage look sound. One blocking CI failure must be resolved before merge.

Blocking

🔧 wrench

• TypeScript lint failure: The new refresh-exclusion tests introduce 12 explicit any casts rejected by @typescript-eslint/no-explicit-any in crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts (beginning at line 1534 and continuing through line 1695). Replace them with the existing typed test-window/PBJS helpers or narrow test interfaces so the blocking lint job passes.

CI Status

• TypeScript lint/format job: FAIL — 12 no-explicit-any errors
• Rust tests and adapter checks: PASS
• Browser and integration tests: PASS
• Vitest: PASS
• Rust and docs formatting: PASS
• CodeQL and analysis: PASS