Improve GPT auction diagnostics observability

[ChristianPavilonis]

Summary

• Link every creative badge to the same stable Ad #N in the TS Console panel and export.
• Add SSAT, SPA Trusted Server, client-side, and genuinely competing-auction classification with winning bidder and bucketed price facts.
• Surface session-gated server auction timings alongside clearly named GAM callback timings, and clean up 1×1 and size terminology.

This is stacked on #1076, which is stacked on #1074. Retarget this PR to main after those dependencies merge.

Changes

File	Change
crates/trusted-server-core/src/publisher.rs	Serialize initial and SPA auction timing facts, preserve generation safety, and gate SPA diagnostics on the active console session.
crates/trusted-server-js/lib/src/integrations/gpt/	Carry immutable auction facts through the initial scheduler and SPA page-bids path.
crates/trusted-server-js/lib/src/integrations/gpt_diagnostics/	Validate, retain, classify, clone, and present auction diagnostics with stable slot numbering.
crates/trusted-server-js/lib/test/ and browser integration tests	Cover timing propagation, session gating, winner validation, classification, stable numbering, terminology, and export isolation.
docs/guide/integrations/gpt-diagnostics.md	Document auction labels, timing origins, winner/privacy boundaries, size behavior, and browser callback semantics.

Closes

Closes #1081

Test plan

• cargo test-fastly && cargo test-axum
• cargo test-cloudflare
• cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (898 passed, no type errors)
• JS lint/build: npm run lint && npm run build
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format/lint/build: cd docs && npm run format && npm run lint && npm run build
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Other: focused Next.js Playwright GPT diagnostics suite (3 passed)

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() added in production code
• Logging conventions preserved; no println! / eprintln! added
• New code has tests
• No secrets or credentials committed