Refuse record creation when a trusted JA4 contradicts the User-Agent #1592

Summary

In the shared app, refuse record creation when a trusted JA4 from ctx.ja4() contradicts the User-Agent's browser family, allow an unknown or missing JA4, and own the family rule's data; delete the direct Fastly JA4 read; verified on Fastly.

Part of #1558, server-side identity on every adapter. Plan ID T12, planned in wave 6 (MVP: Fastly and Axum); priority P1, size M. Design: spec; order and dependencies: plan.

Requirements

ID-7 Abuse resistance

Where a trusted JA4 is available, record creation is refused when the JA4's TLS client family contradicts the User-Agent's browser family; a JA4 the rule does not recognize, or no trusted JA4 at all, does not block (DEC-18). The family rule and its data live in core with T12, which owns keeping them current; JA4 comes only from EdgeZero's ctx.ja4() (EZI-3).

Current state

What the code does today, from the design's survey at the revisions it names:

• ID-7: Fastly checks only that a JA4 exists plus a browser User-Agent platform; main's known-browser table (ec/device.rs) feeds analytics only and needs an HTTP/2 fingerprint that Axum behind CloudFront lacks; the RC's Axum checks only the User-Agent, with request filters, because it has no trusted JA4 (EZI-3); Cloudflare and Spin create no records yet. CloudFront sends JA4 to the origin only in the CloudFront-Viewer-JA4-Fingerprint header, which an origin request policy must forward. Add JA4 request interface design spec edgezero#469's draft design reports Axum as NotExposed and leaves the trusted proxy header to its section 13.1.

Acceptance criteria

• ID-7: On each supported adapter a scripted client with a browser User-Agent and a non-browser JA4 creates no record, a current Chrome, Safari and Firefox JA4 that no list names still creates one, and a request with no trusted JA4 is not refused for lacking one

Dependencies

Blocked by:

• Integration-branch tag with ClientInfo, JA4 and Axum geo binding edgezero#491 Integration-branch tag with ClientInfo, JA4 and Axum geo binding (new in this plan)
• One identity app in core for every adapter #1600 One identity app in core for every adapter (new in this plan)

Blocks:

• Identity features pass on Axum from the shared app #1581 Identity features pass on Axum from the shared app (new in this plan)
• Identity features pass on Cloudflare from the shared app #1596 Identity features pass on Cloudflare from the shared app (new in this plan)
• EC route in the shared app, verified on Fastly #1598 EC route in the shared app, verified on Fastly (new in this plan)