Add DataDome bot protection integration

[jevansnyc]

Summary

• Adds first-party proxying for DataDome bot protection SDK and signal collection API
• Proxies tags.js through /_dd/tags.js path
• Proxies signal collection through /_dd/js/ path
• Rewrites DataDome script URLs in HTML from third-party to first-party paths
• Configurable caching with sensible defaults (3600s TTL)

This allows DataDome to operate in a first-party context, improving reliability and avoiding ad blocker interference while maintaining full bot protection functionality.

Configuration

[integrations.datadome]
enabled = true
# js_key = "YOUR_DATADOME_JS_KEY"  # Optional
sdk_origin = "https://js.datadome.co"
cache_ttl_seconds = 3600
rewrite_sdk = true

Changes

• datadome.rs: New integration module (~500 lines) implementing SDK proxy, signal proxy, and HTML rewriting
• mod.rs: Register DataDome integration
• trusted-server.toml: Add example configuration
• docs/guide/integrations/datadome.md: Integration documentation

Test plan

• Verify build passes (cargo build --release)
• Verify clippy passes (cargo clippy)
• Deploy to test environment with DataDome-enabled origin
• Verify /_dd/tags.js returns DataDome SDK
• Verify signal collection works through /_dd/js/ proxy
• Verify HTML rewriting converts DataDome URLs to first-party paths

Note: Full testing requires Fastly dynamic backends to be enabled on the service.

🤖 Generated with Claude Code