Define integrations crate split and ordered configuration

[aram356]

Summary

• Defines trusted-server-integrations as the static Rust composition crate for all concrete integrations and trusted-server-integrations-js as the owner of integration browser sources and assets.
• Defines one ordered [integrations] inventory with explicit enabled, provider instances nested under their owning integration, and configuration order as the observable runtime priority.
• Replaces APS, Prebid, mediator, lifecycle, and browser reverse dependencies with narrowly typed neutral contracts while preserving current runtime, CLI, cache, and renderer behavior except for the documented configuration and ordering changes.
• Splits delivery into a behavior-preserving crate-boundary milestone and a separately gated ordered-configuration cutover with dual-read rollout and rollback protection.

Scope guardrails

• Current origin/main behavior and the decisions in this spec are authoritative. PRs Add configuration-driven OpenRTB auction providers #1016 and Add the integration provider seam design spec #1084 are historical context only.
• This does not introduce a plugin ecosystem, runtime loading, one crate per vendor, a public integration SDK, or new provider families.
• This PR changes one design document only; it does not implement the architecture.

Intentional compatibility changes

• Auction providers move beneath their owning integration and references become qualified.
• Retained integrations require explicit enabled.
• Configuration declaration order replaces lexical provider priority and controls ordered hooks and browser dispatch.
• APS providers require an enabled APS parent.

Review focus

• Rust/WASM dependency direction and composition ownership.
• Ordered TOML-to-config-store-to-runtime semantics.
• CLI recovery behavior, secret preprocessing, and schema cutover safety.
• Browser shared-state ownership, DOM ordering, and APS/Prebid/GPT renderer lifecycle parity.

Verification

• npm run check in docs (ESLint, Prettier, and VitePress build).
• git diff --check origin/main...HEAD.
• Final independent red-team review found no implementation-blocking issues against origin/main at 4c6d26a16.

Rust and browser runtime test suites were not run because the PR is documentation-only.