Cross-Contract Composability Test Suite

[vijay11149]

Closes #339

Summary

FinchippayContract had no tests exercising real Stellar Asset Contract (SAC) tokens or multi-contract call patterns. This PR adds contracts/finchippay-contract/tests/integration_cross_contract.rs — a four-scenario integration suite that deploys real SAC tokens and mock external contracts against FinchippayContract — and wires the suite into CI.

Changes

New: contracts/finchippay-contract/tests/integration_cross_contract.rs

Test	Scenario	What it verifies
test_sac_token_integration	SAC integration	Deploys a real SAC, locks 2,000 tokens in an escrow, asserts the contract holds them, claims, asserts the recipient received them.
test_multi_token_escrow	Multi-token escrow	Two SACs (TokenA/TokenB), two escrows, per-token balance isolation through claim.
test_decimal_edge_cases	Decimal edge cases	0-decimal token sends 100; 18-decimal token escrows exactly 1_000_000_000_000_000_000 (== MAX_ESCROW_AMOUNT) — no overflow or precision loss.
test_external_caller_auth_propagation	External caller	A mock contract calls send_tip; fails without from auth, succeeds with it, and require_auth is recorded against from.

Supporting in-file test doubles:

• MockToken — minimal SEP-41 token (transfer/balance/decimals/admin mint) with configurable decimals (the SAC is fixed at 7 decimals).
• ExternalCaller — minimal contract forwarding a tip into FinchippayContract to prove auth propagates across the call boundary.

Changed: .github/workflows/ci-contracts.yml

Added cargo test --test integration_cross_contract to the contracts job.

Acceptance criteria

• cargo test --test integration_cross_contract passes all 4 scenarios.
• Multi-token escrow isolates token balances.
• Decimal edge cases don't overflow or lose precision.
• External caller require_auth propagation works.
• CI contracts job runs the new suite.

Implementation notes

1. MockToken::transfer takes to: MuxedAddress to match SEP-41, since token::Client::transfer forwards a muxed address.
2. The external-caller test uses mock_all_auths_allowing_non_root_auth() because from.require_auth() happens inside Finchippay rather than the root invocation.
3. No new dev-dependencies — soroban-sdk with testutils (already present) provides the SAC + auth test utilities.
4. Out of scope (per issue): production multi-contract deployments and upgrade-path testing.

Testing

cd contracts/finchippay-contract
cargo test --test integration_cross_contract

Note: authored in an environment without a Rust toolchain, so the suite still needs to be confirmed by CI or a local cargo test run.