Group batch-sync mappings by EC ID before KV updates

[ChristianPavilonis]

Summary

• Validate the full batch first, then group valid mappings by normalized EC ID in deterministic first-occurrence order.
• Apply only the last valid partner UID for each distinct EC through the existing CAS-protected writer while preserving per-input outcomes.
• Define and test grouped eligibility, error ordering, and infrastructure-abort accounting.

This PR is stacked on #901.

Changes

File	Change
crates/trusted-server-core/src/ec/batch_sync.rs	Group valid mappings before KV work, fan group outcomes back to original indexes, and add ordering/accounting/HTTP coverage
crates/trusted-server-core/src/ec/kv.rs	Add regression coverage for the existing conditional writer's CAS retry behavior
docs/guide/api-reference.md	Document normalized grouping, last-valid-wins, outcome fan-out, sorted errors, and groupwise failure behavior
docs/guide/ec-setup-guide.md, docs/guide/edge-cookies.md	Align operational guidance with the grouped contract
docs/superpowers/plans/2026-07-13-issue-882-group-batch-sync-by-ec-id.md	Record the reviewed design and verification contract

Closes

Closes #882

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve — not run
• Other: focused grouped batch-sync/CAS tests, cargo test-cloudflare, cargo test-spin, cross-adapter parity, and all Cloudflare/Spin native + WASM clippy targets

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed