Align Didomi API proxy paths and methods with the vendor contract

[prk-Jr]

Description

Audit and correct the Didomi API reverse-proxy path transformation and supported methods.

Didomi's main reverse-proxy guideline says a publisher request such as POST /consent/api/events should be sent to the API origin as POST /events. Trusted Server currently selects the API backend for /api/* but builds the upstream URL with the complete /api/* remainder, producing /api/events. The integration also registers only GET and POST routes even though its CORS response advertises GET, POST, PUT, DELETE, and OPTIONS.

This behavior predates the trusted loader geo work in PR #1127. Didomi's provider-specific examples are not fully consistent about the API prefix, so implementation work should first verify the current authoritative contract and actual SDK request methods.

Reproduction steps

1. Enable the Didomi integration with a stub API origin.
2. Send POST /integrations/didomi/consent/api/events.
3. Observe that the upstream path is /api/events rather than /events.
4. Send each method Didomi currently requires and compare routing with the advertised CORS methods.

Expected behavior

Trusted Server should transform API paths and support methods according to Didomi's current reverse-proxy contract, without caching API requests or responses.

Done when

• The authoritative current Didomi API path and method contract is documented with a vendor reference.
• API proxy paths are transformed accordingly for default and custom proxy prefixes.
• Every required method forwards its query, headers, and bounded body correctly.
• Unsupported methods return the intended response, and CORS advertising matches routed methods.
• API cache bypass and private response behavior remain covered.

Affected area

Integrations (Didomi)

Version

Current main; behavior predates PR #1127.