Address PR #80 review: harden verification trust model and align docs with fixed pricing

- Cross-check ext.trusted_server host/scheme against server-observed values
- Enforce timestamp freshness window (±5 min) to prevent replay attacks
- Add field-order warning comment on SigningPayload struct
- Fix ts unit mismatch: align tests with docs (milliseconds)
- Add positive-path Ed25519 round-trip test with deterministic keypair
- Remove debug log leftover in fetch_jwks
- Simplify APS size selection to area-based ranking (replaces CPM)
- Remove CPM from /sizes endpoint response
- Rename test to test_ext_bid_override_is_ignored
- Docs sweep: remove bid override references across all doc pages

Author: ChristianPavilonis

crates/mocktioneer-core/src/auction.rs

@@ -241,21 +241,21 @@ pub fn build_aps_response(req: &ApsBidRequest, base_host: &str) -> ApsBidRespons
     let mut slots: Vec<ApsSlotResponse> = Vec::new();
 
     for slot in req.slots.iter() {
-        // Find the standard size with the highest CPM from all sizes in the slot
+        // Find the standard size with the largest area from all sizes in the slot
         let best_size = slot
             .sizes
             .iter()
             .filter_map(|&[w, h]| {
                 let w_i64 = w as i64;
                 let h_i64 = h as i64;
                 if is_standard_size(w_i64, h_i64) {
-                    let price = get_cpm(w_i64, h_i64);
-                    Some((w, h, price))
+                    let area = w_i64 * h_i64;
+                    Some((w, h, area))
                 } else {
                     None
                 }
             })
-            .max_by(|a, b| a.2.partial_cmp(&b.2).unwrap_or(std::cmp::Ordering::Equal));
+            .max_by_key(|&(_, _, area)| area);
 
         let Some((w, h, _)) = best_size else {
             // No standard sizes found, skip this slot
@@ -471,7 +471,7 @@ mod tests {
     }
 
     #[test]
-    fn test_price_from_ext_and_iframe_bid_param() {
+    fn test_ext_bid_override_is_ignored() {
         let req = OpenRTBRequest {
             id: "r4".to_string(),
             imp: vec![OpenrtbImp {
@@ -548,12 +548,12 @@ mod tests {
     }
 
     #[test]
-    fn test_build_aps_response_selects_highest_cpm() {
+    fn test_build_aps_response_selects_largest_area() {
         let req = ApsBidRequest {
             pub_id: "test".to_string(),
             slots: vec![ApsSlot {
                 slot_id: "slot1".to_string(),
-                sizes: vec![[300, 250], [970, 250]], // 970x250 has higher CPM ($4.20 vs $2.50)
+                sizes: vec![[300, 250], [970, 250]], // 970x250 has larger area (242500 vs 75000)
                 slot_name: None,
             }],
             page_url: None,
@@ -564,7 +564,7 @@ mod tests {
 
         assert_eq!(resp.contextual.slots.len(), 1);
         let slot = &resp.contextual.slots[0];
-        assert_eq!(slot.size, "970x250"); // Should pick higher CPM size
+        assert_eq!(slot.size, "970x250"); // Should pick largest area
     }
 
     #[test]

crates/mocktioneer-core/src/routes.rs

@@ -239,6 +239,14 @@ pub async fn handle_openrtb_auction(
     ForwardedHost(host): ForwardedHost,
     ValidatedJson(req): ValidatedJson<OpenRTBRequest>,
 ) -> Result<Response, EdgeError> {
+    // Determine server-observed scheme from X-Forwarded-Proto header, default to "https"
+    let scheme = ctx
+        .request()
+        .headers()
+        .get("x-forwarded-proto")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("https");
+
     // Capture signature verification status for metadata
     let signature_status = if let Some(domain) = req.site.as_ref().and_then(|s| s.domain.as_deref())
     {
@@ -247,6 +255,8 @@ pub async fn handle_openrtb_auction(
             &req.id,
             req.ext.as_ref(),
             domain,
+            &host,
+            scheme,
         )
         .await
         {
@@ -498,22 +508,19 @@ pub async fn handle_click(ValidatedQuery(params): ValidatedQuery<ClickQueryParam
 /// ```json
 /// {
 ///   "sizes": [
-///     {"width": 300, "height": 250, "cpm": 2.5},
-///     {"width": 728, "height": 90, "cpm": 3.0},
+///     {"width": 300, "height": 250},
+///     {"width": 728, "height": 90},
 ///     ...
 ///   ]
 /// }
 /// ```
 #[action]
 pub async fn handle_sizes() -> Response {
-    use crate::auction::get_cpm;
-
     let sizes: Vec<serde_json::Value> = standard_sizes()
         .map(|(w, h)| {
             serde_json::json!({
                 "width": w,
-                "height": h,
-                "cpm": get_cpm(w, h)
+                "height": h
             })
         })
         .collect();
@@ -1002,6 +1009,7 @@ mod tests {
         let first = &sizes[0];
         assert!(first["width"].is_i64());
         assert!(first["height"].is_i64());
-        assert!(first["cpm"].is_f64());
+        // CPM is no longer included — bid price is fixed at FIXED_BID_CPM
+        assert!(first.get("cpm").is_none());
     }
 }