State<T> + nested/array #[secret] + Fastly dispatch fidelity (P0-C) + app! app-state (P0-D)

[aram356]

Four independent upstream primitives for the trusted-server -> EdgeZero migration, stacked on #300 (introspection routes; base worktree-feature+introspection-routes, auto-retargets to main when #300 merges).

Closes #304. Base depends on #300.

Note on #283 (JA4): C3 below provides the Fastly raw-request hook a JA4 interface could build on, but this PR does not deliver #283 (a standard cross-adapter JA4 API). There is no neutral JA4 type, no get_tls_ja4() wiring, and it's Fastly-only. #283 remains open as follow-up.

Specs: docs/superpowers/specs/2026-07-02-edgezero-state-and-nested-secrets-design.md (A+B), docs/superpowers/specs/2026-07-03-edgezero-p0cd-fastly-dispatch-and-appstate-design.md (P0-C/P0-D). Task-by-task plans under docs/superpowers/plans/ (all boxes checked).

Workstream A -- State<T> extractor

• State<T> extractor (FromRequest by type from request extensions; Deref/DerefMut/into_inner; 500 when unregistered).
• RouterBuilder::with_state<T> stores app state in a single Extensions bag; dispatch does request.extensions_mut().extend(state.clone()) after the introspection injects (last-write-wins by TypeId). Zero macro change -- #[action] composes State<T> via the generic FromRequest path.
• Docs: docs/guide/handlers.md "Sharing app state".

Workstream B -- nested / array #[secret]

• Owned, path-qualified SecretField { kind, path: Vec<SecretPathSegment>, optional }; AppConfigMeta::secret_fields() -> Vec<SecretField> (was const SECRET_FIELDS); dotted_path().
• Derive: #[app_config(nested)] opt-in recurses into sub-struct / Vec<_> fields; accepts Option<String>; rejects Option<String> on #[secret(store_ref)]; empty/bare #[app_config] hard-errors; AppConfigRoot bound assertion; serde rename/rename_all guards extended along the path.
• Runtime secret_walk is a path navigator (nested objects, arrays per-element, optional absent/null skip, KeyInNamedStore sibling resolved in the innermost parent, dotted [n] errors).
• Push: nested/list-aware validate_excluding_secrets pruning.
• CLI: path-aware TOML collector powers config validate/push/diff; TypedSecretEntry carries a dotted label.
• CI: the nested-AppConfig audit guard is inverted -- nesting allowed iff the field opts in via #[app_config(nested)].
• Docs: docs/guide/configuration.md "Nested and array secrets".

P0-C -- Fastly run_app dispatch fidelity

• C1 multi-value response headers: set_header->append_header in from_core_response and the proxy response/request conversion (origin Set-Cookie no longer collapses).
• C2 Hooks::owns_logging() -- platform-neutral opt-out gated in all four adapters' run_app; app!(owns_logging = <bool>) macro argument.
• C3 run_app_with_request_extensions -- a generic pre-dispatch hook: an app closure reads raw-fastly::Request signals (e.g. JA4 / H2 / client IP -- the app supplies the closure and its own type) into a scratch Extensions before conversion, merged into the core request; visible to middleware and the State/extractor layer.

P0-D -- app! app-state injection

• app!(state = <expr>) makes the macro-generated build_router() call .with_state(<expr>), reusing Workstream A's dispatch injection. Macro-only -- no adapter or Hooks change.
• app-demo gains a state = crate::app_state() + State<Arc<DemoState>> handler with an end-to-end test.

Tests / CI gates (all green locally)

cargo fmt, cargo clippy --workspace --all-targets --all-features -D warnings, cargo test --workspace --all-targets, feature check (fastly cloudflare spin), spin wasm32-wasip2, the nested-AppConfig audit, app-demo (own workspace) tests + clippy, and the Fastly adapter's wasm32-wasip1 + Viceroy tests (C1/C3).

Notes

• The Fastly adapter is wasm-only -- its tests run via wasm32-wasip1 + Viceroy from the crate dir, not host cargo test.
• No workspace-wide lint allows added; the only new #[expect] are documented dead_code on #[derive(AppConfig)] test fixtures.