Add a server-side ad template switch and cache policy

[ChristianPavilonis]

Summary

• Add a clear [creative_opportunities].enabled switch for publisher server-side ad-template delivery.
• Set inactive publisher HTML to a short browser cache policy (max-age=60) without weakening origin privacy or changing CDN-specific cache headers.
• Keep direct POST /auction available when publisher templates are disabled.

Issue #1007 exposed that publisher HTML caching was tied to whether the server-side ad stack ran, while the global auction setting also controlled unrelated auction behavior. This change separates publisher template delivery from the direct auction API and makes the cache behavior explicit.

Changes

File	Change
crates/trusted-server-core/src/creative_opportunities.rs	Adds the default-true enabled configuration field and serialization coverage.
crates/trusted-server-core/src/settings.rs	Hides creative-opportunity slots from runtime handlers when template delivery is disabled and tests environment overrides.
crates/trusted-server-core/src/config.rs	Verifies compatibility for omitted defaults and explicit disabled values.
crates/trusted-server-core/src/publisher.rs	Gates publisher HTML and page-bids template delivery, records the disabled-template reason, and tests cache behavior.
crates/trusted-server-core/src/auction/endpoints.rs	Proves direct POST /auction still dispatches when templates are disabled.
trusted-server.example.toml	Documents the new setting in the example configuration.
docs/guide/configuration.md	Documents the switch, cache policy, and environment override.
CHANGELOG.md	Records the new switch and cache behavior.
crates/trusted-server-js/lib/src/core/index.ts	Clarifies browser defaults when template delivery is gated.
crates/trusted-server-js/lib/src/integrations/gpt/index.ts	Clarifies page-bids behavior when template delivery is disabled.
crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts	Updates the related regression-test explanation.

Scope

The change is limited to configuration, core publisher/page-bids execution, direct-auction regression coverage, browser comments, and documentation. Existing adapter routes already use the centralized settings accessor, so no divergent adapter-specific switch was needed. Active server-side templates retain private, no-store; inactive cacheable HTML uses max-age=60, while origin private/no-store, validators, and CDN-specific headers remain unchanged.

Closes

Closes #1007

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format (Prettier is unavailable in the docs workspace)
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, focused publisher tests, and all configured native/WASM clippy targets

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses project logging macros, not println!
• New code has tests
• No secrets or credentials committed