EdgeZero full migration (umbrella tracker)

[aram356]

Umbrella tracker for moving Trusted Server completely onto EdgeZero primitives.

Design spec: docs/superpowers/specs/2026-07-02-edgezero-full-migration-design.md (PR #839)

Foundation-first phase order. Phase 0 is an upstream edgezero prerequisite (separate repo/PR). Each phase gets its own implementation plan/PR.

Phases

• Phase 0 — EdgeZero prerequisites: State<T> extractor + nested/array #[secret] — edgezero PR add State<T> + nested #[secret] design spec stackpop/edgezero#305
• Phase 1 — EdgeZero migration Phase 1 — Stores onto EdgeZero StoreRegistry #841 Stores onto EdgeZero StoreRegistry
• Phase 2 — EdgeZero migration Phase 2 — Finish config injection (no embedded toml) #842 Finish config injection (Cloudflare + Spin; drop config crate)
• Phase 3 — EdgeZero migration Phase 3 — Full secret externalization #843 Full secret externalization (depends on Phase 0)
• Phase 4 — EdgeZero migration Phase 4 — Handlers to extractors #844 Handlers → #[action] extractors (depends on Phase 0)
• Phase 5 — EdgeZero migration Phase 5 — Delete legacy Fastly path (gated) #845 Delete legacy Fastly path (gated on 100% rollout, Fastly entry point switch (dual-path with flag) #495)

Key decisions

• D1: load-once Arc<Settings> via State<Settings> (not per-request AppConfig<C>)
• D2: integration proxy router migration deferred (Phase 4b)
• D3: secrets resolve at startup
• D4: collapse TrustedServerAppConfig onto Settings