Add ts ec show and ts ec eids commands for the admin Edge Cookie diagnostics #1432

Description

Operators reach two admin diagnostic routes with curl today:

• GET /_ts/admin/ec/{id} returns the stored identity-graph record for an EC ID, plus a preview of the partner EIDs that record can contribute to an auction. Only the Fastly adapter serves it; the others return 501.
• GET /_ts/admin/eids decodes the request's ts-eids and sharedId cookies and previews which configured partners cookie ingestion would match or drop.

The curl form puts the shared admin password in shell history, the same problem #1430 fixes for key rotation. The EIDs route also makes the operator build a Cookie header by hand from values copied out of browser DevTools.

Proposed commands

ts ec show --service https://edge.example.com <ec-id>
ts ec eids --service https://edge.example.com [--ts-eids <value>] [--shared-id <value>]

Done when

• ts ec show checks the EC ID format (64 lowercase hex characters, a dot, 6 alphanumerics) before sending anything.
• ts ec show prints the tombstone state and the auction EID preview, including skipped IDs and why they were skipped, and --json prints the full response unchanged.
• A 404 reads as "no record for this EC ID", and a 501 explains that only the Fastly adapter holds the identity graph.
• ts ec eids requires at least one cookie value, sends the values as the request's cookies, and prints the matched and unmatched partner IDs with their reasons.
• Both commands share the admin client from Add ts keys rotate and ts keys deactivate commands #1430: password from TRUSTED_SERVER_ADMIN_PASSWORD only, the same service URL checks, the same 401 hint.
• The responses carry raw consent strings and partner UIDs. The commands print them to the terminal and write nothing to disk or to logs.
• The bare GET /_ts/admin/ec route, which reads the EC ID from the ts-ec cookie, is not wrapped; ts ec show <ec-id> covers it.
• The "Admin Diagnostic Endpoints" section of docs/guide/api-reference.md shows both commands.
• Tests run both commands against a local fixture.

Affected area

CI / Tooling

Related

#1271 proposes removing these routes. This issue works with the routes as they are today and does not wait on that change.