ts-ec refresh for returning readers without breaking cacheability #1595

Summary

ts-ec refresh for returning readers without breaking cacheability.

Part of #1558, server-side identity on every adapter. Plan ID T16, planned in an any row (no fixed wave; starts when its decision or reviewer is ready; after the MVP); priority P3, size S. Design: spec; order and dependencies: plan.

Requirements

WB-2 ts-ec lifetime

ts-ec keeps Domain=.<publisher>; Path=/; Secure; SameSite=Lax; HttpOnly; Max-Age=31536000. Whether returning readers get a refresh is DEC-13.

WB-5 Cacheable pages

An unchanged cookie gets no Set-Cookie, and a response carrying Set-Cookie is not stored in a shared cache.

Current state

What the code does today, from the design's survey at the revisions it names:

• WB-2: set only for a new or rotated EC.
• WB-5: main enforces the cache rule on every adapter (response_privacy.rs:122-148) and does not re-set ts-ec, but re-sets the ts-ec-pull-complete marker about hourly, which Mirror provider EIDs to a cookie and run pull sync as an identity provider #1489 retires; the deny list names only sharedId.

Acceptance criteria

• WB-2: Once DEC-13 is decided, its rule holds and a returning reader whose cookie needs no refresh gets no Set-Cookie
• WB-5: A returning reader with unchanged cookies gets no Set-Cookie, and the template-cache deny list uses the configured SharedID name

Dependencies

Blocked by:

Waits on these decisions:

• DEC-13 ts-ec refresh (open). for returning readers. Blocks T16.