Deploy validation per target adapter and registered provider kind #1552

Follow-up from PR #1487.

Description

PR A rejects every enabled provider at deploy time because no kind is registered. Once kinds ship (#1488), a config with an enabled provider pushed to an Axum, Cloudflare or Spin service would pass validation and then fail startup there.

Proposed direction: In the CLI, build every enabled provider through the provider crate's registered kinds, and run reject_enabled_providers when the resolved target adapter is not Fastly.

Done when

• CLI validate, push and diff build every enabled provider through the registered kinds.
• reject_enabled_providers runs when the resolved target adapter is not Fastly.
• Tests cover an enabled provider for Fastly (accepted when the kind is registered) and for Axum, Cloudflare and Spin (rejected).

Affected area

CI / Tooling

Code: crates/trusted-server-core/src/config.rs (reject_providers_without_a_kind); crates/trusted-server-cli/src/run.rs (push, diff and validate wrappers); ec/provider.rs (reject_enabled_providers).

Review threads

• Collect server-side identity provider EIDs in a single page-load write #1487 (comment)