Add S3 auth and Fastly IO asset routes

[ChristianPavilonis]

Summary

• Add multi-backend first-party asset routes with route matching and proxy handling.
• Add S3 SigV4 authentication and Fastly Image Optimizer support for asset backends.
• Update Fastly adapter wiring, configuration examples, docs, and route coverage.

Changes

File	Change
crates/trusted-server-core/src/proxy.rs	Adds asset route resolution/proxying behavior and backend request handling.
crates/trusted-server-core/src/settings.rs	Adds asset route, backend, S3 auth, and Fastly IO configuration parsing/validation.
crates/trusted-server-core/src/s3_sigv4.rs	Adds S3 Signature Version 4 signing support.
crates/trusted-server-core/src/asset_image_optimizer.rs	Adds Fastly Image Optimizer request support for asset routes.
crates/trusted-server-core/src/platform/http.rs and platform support files	Adds HTTP/platform abstractions needed by asset routes.
crates/trusted-server-adapter-fastly/src/main.rs, platform.rs, route_tests.rs	Wires the Fastly adapter to asset route handling and expands route tests.
docs/guide/asset-routes.md, docs/guide/configuration.md, docs/guide/first-party-proxy.md, docs/superpowers/specs/*	Documents asset routes, S3 auth, Fastly IO, and supporting design specs.
trusted-server.toml	Adds sample asset route/backend configuration.

Closes

TBD — no issue number provided while opening this draft PR.

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Not run in this session; PR opened as draft for review.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed