Make Axum consume the local config store written by ts config push #1141

Context

ts config push --adapter axum --local writes a local app-config envelope under .edgezero/. Axum startup reads a config-store-shaped environment variable through AxumPlatformConfigStore instead of opening that file. The existing scripts/smoke-axum.sh reads the pushed envelope and exports TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG_TRUSTED_SERVER_CONFIG before starting the adapter. This manual bridge is documented in docs/guide/axum-dev.md and was the gap reported during PR #1049.

Desired outcome

ts config push --adapter axum --local and ts serve --adapter axum have one supported local configuration handoff that an operator can follow without reconstructing it from internal store naming.

Scoped work

Decide whether Axum should consume the pushed local file directly or whether the CLI should explicitly export or launch with the required environment variable. Implement the chosen contract in the relevant commands or adapter, including its missing-config and invalid-envelope behavior. Retain secret handling through the documented local secret variables unless the chosen contract requires a deliberate change.

Done when

• A test or local smoke pushes an isolated config and starts Axum through the documented supported path without an undocumented manual conversion.
• The test confirms the running adapter uses the pushed setting and rejects a missing or malformed envelope with a clear error.
• ts serve, ts config push, the smoke script, and the Axum guide describe the same handoff.
• The old bridge limitation is removed or explicitly kept as the supported behavior.

Evidence

Original PR #1049 finding; current crates/trusted-server-adapter-axum/src/app.rs and platform.rs, scripts/smoke-axum.sh, and docs/guide/axum-dev.md at 666953a0d.