Rename Synthetic ID to Server Side Cookie (SSC) and simplify generation

[ChristianPavilonis]

Summary

• Rename "Synthetic ID" to "Server Side Cookie (SSC)" across all external-facing identifiers, config, internal Rust code, and documentation
• Simplify SSC hash generation to use only client IP (IPv4 or /64-masked IPv6) with HMAC-SHA256, removing User-Agent, Accept-Language, Accept-Encoding, random_uuid inputs and Handlebars template rendering
• Downgrade SSC ID generation logs from info to debug level since client IP is sensitive data

Changes

File	Change
crates/common/src/ssc.rs (new)	Renamed from synthetic.rs; simplified hash to IP-only HMAC-SHA256; removed template rendering
crates/common/src/synthetic.rs (deleted)	Replaced by ssc.rs
crates/common/src/constants.rs	Renamed constants: SYNTHETIC_ID_HEADER → SSC_HEADER, cookie/query names updated
crates/common/src/cookies.rs	Updated cookie name synthetic_id → ts-ssc, function names to SSC
crates/common/src/error.rs	Renamed SyntheticId → Ssc error variant; removed Template variant
crates/common/src/settings.rs	Config section [synthetic] → [ssc] with alias = "synthetic" for backward compat; removed template field
crates/common/src/settings_data.rs	Updated settings data references to SSC
crates/common/src/lib.rs	Module rename synthetic → ssc
crates/common/src/http_util.rs	Updated header references to SSC naming
crates/common/src/openrtb.rs	Wire field synthetic_fresh → ssc_fresh
crates/common/src/proxy.rs	Updated query param synthetic_id → ts-ssc
crates/common/src/publisher.rs	Updated SSC references
crates/common/src/auction/formats.rs	Response headers: X-Synthetic-ID → X-TS-SSC, X-Synthetic-Fresh → X-TS-SSC-Fresh, X-Synthetic-Trusted-Server → X-TS-SSC-Trusted-Server
crates/common/src/integrations/*.rs	Updated SSC references across all integrations
crates/common/src/test_support.rs	Updated test helpers for SSC naming
crates/common/Cargo.toml	Removed handlebars dependency
crates/js/lib/src/integrations/gpt/index.ts	Updated header name reference
Cargo.lock	Removed handlebars-related entries
trusted-server.toml	Config section [synthetic] → [ssc]; removed template field
CLAUDE.md	Updated file paths and terminology
docs/**/*.md (30+ files)	Renamed SyntheticID → Server Side Cookie throughout documentation

Closes

Closes #462

Test plan

• cargo test --workspace — 473 tests passing
• cargo clippy --all-targets --all-features -- -D warnings — zero warnings
• cargo fmt --all -- --check — clean
• JS tests: cd crates/js/lib && npx vitest run — 239 tests passing

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed

[aram356]

Summary

Comprehensive rename of Synthetic ID → Server Side Cookie (SSC) with simplified HMAC generation (client IP only, dropping Handlebars templates). Cookie, header, query parameter, config section, and error variants are all renamed. The handlebars dependency is removed.

Blocking

🔧 wrench

• Missing new SSC headers in INTERNAL_HEADERS: x-ts-ssc-fresh and x-ts-ssc-trusted-server are defined but not added to the INTERNAL_HEADERS blocklist, allowing potential leak of user-identity headers to third-party origins via copy_custom_headers (crates/common/src/constants.rs:49)

Non-blocking

🤔 thinking

• Cookie name break: synthetic_id → ts-ssc silently invalidates existing user cookies (crates/common/src/constants.rs:3)
• Query parameter break: synthetic_id → ts-ssc in proxy forwarding may break downstream consumers (crates/common/src/proxy.rs:438)
• Entropy reduction: HMAC now uses only client IP; users behind same NAT share the HMAC prefix (crates/common/src/ssc.rs:63)

📝 note

• Silent template field removal: Old configs with template = "..." are silently ignored (no deny_unknown_fields). Operators won't know the field is unused.

CI Status

• cargo fmt: PASS
• cargo clippy: PASS
• cargo test: PASS
• vitest: PASS
• format-docs: PASS
• format-typescript: PASS
• CodeQL: PASS

[prk-Jr]

Summary

This PR completes the Synthetic ID → Server Side Cookie rename and simplifies ID generation, but I found a couple of migration/privacy regressions plus a docs/behavior mismatch that should be fixed before merge.

Blocking

🔧 wrench

• Docs and implementation diverge on consent + proxy behavior: the new SSC docs state that ID generation/forwarding are consent-gated and that /first-party/proxy generates a new SSC ID when missing, but the current implementation still generates IDs unconditionally in crates/common/src/publisher.rs:239, crates/common/src/integrations/registry.rs:659, and crates/common/src/auction/formats.rs:81, while proxy forwarding only reuses an existing ID in crates/common/src/proxy.rs:427. Either implement the documented rules or update the docs so they match the code.

CI Status

• fmt: PASS
• clippy: PASS
• rust tests: PASS
• js tests: PASS

Addressed: added x-ts-ssc-fresh to INTERNAL_HEADERS, removed x-ts-ssc-trusted-server. Non-blocking items are intentional design choices.