Remember NoMatch and failed provider lookups to stop per-navigation vendor calls #1547

Follow-up from PR #1487.

Description

A NoMatch (404/204), an error or a timeout writes nothing to the row, so due_sources makes the source due again on the next navigation. An unmatched visitor sends the EC ID, IP and UA to the vendor on every page view. The only brake is rate_limit_per_hour, which is unlimited by default. A vendor that answers 204 to anonymous gdpr=1 lookups hits this for every such visitor.

Reproduction steps

1. Configure an enabled identity provider (fictional example: example-provider, https://id.example.com).
2. Exercise the path described above with a test EC (for example ec-0000-test).
3. Observe the behaviour described.

Expected behavior

Store a per-provider retry-after on the row, like opt_outs: short for failures and longer for NoMatch, kept distinct from each other. Skip a provider while its retry-after is live. Until then, give providers a default rate_limit_per_hour, or gate the first vendor kind (#1488) on this issue.

Acceptance criteria

• A NoMatch, error or timeout result records a per-provider retry-after on the EC row, with distinct durations for failures and NoMatch.
• due_sources skips a provider while its retry-after is live.
• Until then, providers have a finite default rate_limit_per_hour, or Add identity providers for ID5, LiveIntent, LiveRamp, ConnectID and UID2 #1488 is gated on this issue.
• Tests cover NoMatch, error and timeout suppression and expiry of the retry-after.

Affected area

Core (Edge Cookies, GDPR)

Code: crates/trusted-server-core/src/ec/coordinator/mod.rs (due_sources, the NoMatch/error/timeout arms of collect); ec/write_plan.rs (apply_lookups); ec/kv_types.rs (row schema, next to opt_outs).

Version

main with PR #1487 (feat/s2s-eid-after-response).

Review threads

• Collect server-side identity provider EIDs in a single page-load write #1487 (comment)