Forward trusted geo to Didomi notice loaders

[prk-Jr]

Summary

• Add opt-in trusted country and region parameters to Didomi notice-loader URLs so browser and edge-cache identities select the correct geographic notice.
• Canonicalize eligible loader requests through a private same-origin redirect, replace caller-supplied geo, and fail closed when complete trusted geo is unavailable.
• Preserve Didomi SDK cache metadata while bypassing cache and enforcing private responses for Didomi API traffic.

Changes

File	Change
crates/trusted-server-core/src/integrations/didomi.rs	Adds typed configuration, geo normalization, exact loader matching, canonical redirects, authoritative upstream headers, API cache privacy, and regression coverage.
crates/trusted-server-core/src/config_payload.rs	Verifies the new option survives the deployed configuration blob round trip.
crates/trusted-server-adapter-fastly/src/platform.rs	Verifies query encoding, order, and duplicates survive Fastly request conversion.
trusted-server.example.toml	Documents the disabled-by-default TOML option.
crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml	Adds the option to the integration fixture.
docs/guide/integrations/didomi.md	Replaces the stale guide with the current TOML/typed-CLI configuration flow, corrects the inaccurate claim that publisher Authorization is forwarded, and documents geo, caching, limitations, and rollout checks.
docs/superpowers/specs/2026-09-07-didomi-geo-design.md	Records the reviewed design and acceptance criteria.
docs/superpowers/plans/2026-09-07-didomi-geo-forwarding.md	Records the completed implementation and verification plan.

Rollout considerations

• A notice-loader request with country but no valid region returns a private 503. This is a deliberate availability decision because the canonical cache identity requires both fields; Fastly can omit region for locations without an ISO subdivision.
• The option defaults to false. Manual staging verification with real Fastly geo does not block merging the disabled feature, but it must be completed before enabling geo_query_parameters for production traffic.
• Follow-up Replace caller-supplied Didomi geo headers with trusted platform geo #1151 tracks replacing legacy caller-supplied geo headers on other Didomi SDK paths. Follow-up Avoid the first-load Didomi geo redirect #1152 tracks avoiding the first-load redirect by exposing trusted geo to the browser bootstrap. Follow-up Align Didomi API proxy paths and methods with the vendor contract #1153 tracks the pre-existing API path and method contract audit.

Closes

Closes #85

Test plan

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare && cargo test-spin
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
• cargo clippy-cloudflare-wasm && cargo clippy-spin-native && cargo clippy-spin-wasm
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (Node 24.12.0; 893 passed)
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• Adapter parity: cargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity
• Focused Didomi tests: cargo test --package trusted-server-core --target aarch64-apple-darwin didomi
• CLI and native integration-test package suites
• WASM release build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Local headless-Chrome verification through ts dev proxy and Viceroy: conflicting geo returned a private 307, then the canonical loader returned 200.
• Manual staging verification with real Fastly geo, browser redirects, cache reuse, and Didomi notice selection (required before production enablement, not before merge)

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() added in production code
• Uses repository log macros and no println!
• New code has tests
• No secrets or credentials committed

[ChristianPavilonis]

Summary

Reviewed the trusted geo forwarding flow through canonical redirects, upstream request construction, response privacy, and Fastly cache behavior. I found no actionable issues in revision eb4e9431695fdcfcf65cdcb7bd2bc3d6cc72cd2d.