Emit absolute creative rewrite URLs

[ChristianPavilonis]

Summary

• Add validated publisher.public_origin (with the legacy https://{publisher.domain} fallback) and emit absolute first-party URLs for creative proxy/click rewrites, creative TSJS, sign responses, rebuild responses, and auction adm.
• Anchor creative runtime sign/rebuild requests and first-party proxy detection to the injected classic script origin; preserve raw-resource and absolute GET fallback behavior when JSON requests fail.
• Register GET rebuild routing across all adapters and document the browser-facing-origin contract.

Changes

File	Change
crates/trusted-server-core/src/settings.rs	Add, validate, serialize, and test publisher.public_origin.
crates/trusted-server-core/src/{creative,proxy}.rs	Qualify generated creative endpoints and support absolute/legacy rebuild inputs.
crates/trusted-server-js/lib/src/integrations/creative/	Capture the injected script origin and resolve dynamic sign/rebuild endpoints from it.
Adapter app/routes and parity tests	Route GET /first-party/proxy-rebuild consistently.
docs/, example config, and changelog	Document the public-origin and absolute-output contract.

#907 remains independent: this change preserves the current TSJS module-set source/hash selection and qualifies only the selected creative script source. #916 remains independent: this branch is based directly on main and does not change optional-rewrite behavior.

Closes

Closes #915

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Cloudflare and Spin native/WASM clippy; Fastly/Axum/Cloudflare/Spin tests; full adapter parity; integration-test clippy; CLI/codegen checks and tests; JS build/lint; docs lint/build; Fastly and Spin release builds.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!) — no logging was added; this repository uses log macros.
• New code has tests
• No secrets or credentials committed