Enforce auction timeout in orchestrator wait logic

[ChristianPavilonis]

Summary

• Enforce the configured auction timeout (settings.auction.timeout_ms) in the orchestrator's select() loop — previously, waits could extend to the backend's hardcoded 15s first_byte_timeout, ignoring the auction deadline.
• Two complementary mechanisms: (1) each auction provider's backend first_byte_timeout is set to timeout_ms instead of 15s, and (2) the orchestrator checks elapsed time after each select() return, dropping remaining requests when the deadline is exceeded.
• Mediator receives remaining time budget after the bidding phase, preventing mediation from extending the auction past the configured deadline.

Changes

File	Change
crates/common/src/backend.rs	Add configurable first_byte_timeout field to BackendConfig (default 15s), builder method, timeout-aware backend naming, and from_url_with_first_byte_timeout() convenience method
crates/common/src/auction/orchestrator.rs	Add deadline enforcement in select() loop — track auction_start, drop remaining requests when timeout exceeded, pass only remaining time to mediator
crates/common/src/integrations/prebid.rs	Use from_url_with_first_byte_timeout() with context.timeout_ms for bid requests
crates/common/src/integrations/aps.rs	Use from_url_with_first_byte_timeout() with context.timeout_ms for bid requests; rename _context → context
crates/common/src/integrations/adserver_mock.rs	Use from_url_with_first_byte_timeout() with context.timeout_ms for mediation requests

Closes

Closes #405

Test plan

• cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• JS tests: cd crates/js/lib && npx vitest run
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other:

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed