Exclude GAM paths from Prebid refresh auctions

[ChristianPavilonis]

Summary

• Add an operator-configured GAM ad-unit-path suffix opt-out for Trusted Server Prebid refresh auctions.
• Preserve GAM refreshes and normal-slot auctions, including mixed global refreshes.
• Document matching, validation, and external-bundle rollout requirements.

Changes

File	Change
crates/trusted-server-core/src/integrations/prebid.rs	Add validated, deduplicated suffix config and inject it into the managed Prebid browser config.
crates/trusted-server-js/lib/src/integrations/prebid/index.ts	Exclude matching GPT paths from synthetic refresh ad units while retaining their GPT refresh.
crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts	Cover explicit, all-excluded, mixed, fail-open, and literal matching behavior.
docs/guide/integrations/prebid.md	Document configuration semantics and deployment requirements.
trusted-server.example.toml	Add a commented configuration example.
docs/superpowers/{specs,plans}/2026-07-24-prebid-refresh-gam-path-opt-out*	Add the approved design and implementation plan.

Closes

Closes #964

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Cloudflare and Spin tests; all configured clippy targets; integration parity tests; supported external Prebid bundle build to /tmp/trusted-server-prebid-refresh-path-opt-out.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• No new logging was required; no println! was added
• New code has tests
• No secrets or credentials committed