Resolve unused lockr app_id configuration requirement #1519

Problem

LockrConfig.app_id is required and validated as nonempty when lockr is enabled, but the runtime integration never reads self.config.app_id.

Evidence at commit 41dcf1f:

• Configuration and validation require the value.
• The SDK proxy fetches the configured SDK unchanged, and API proxying does not consume the configured application ID.
• The lockr guide instructs publishers to retain their page metadata and initialization. Trusted Server does not inject them.

Consequently, an enabled configuration can be rejected for lacking a field that has no runtime effect. The audit extraction in #1496 fills the existing configuration field, but does not resolve that runtime contract.

Follow-up

Determine whether Trusted Server should consume this ID or whether the nonempty requirement should be removed. Implement the chosen behavior with documentation and regression coverage. Assess compatibility for existing operator configs and audit-generated drafts before changing validation or field handling.

Changing the runtime requirement or SDK behavior is outside #1496.

Requested in #1496 (review).