feat: delegate withdrawal — position owner specifies a separate recipient address

[abayomicornelius]

Summary

Currently, collateral and PnL from a closed position are always sent to the original position owner (env.invoker()). Add a recipient: Option<Address> field to decrease and withdrawal orders so traders can direct funds to a different wallet (e.g., a cold storage address or a multi-sig vault).

Proposed Design

• Add recipient: Option<Address> to CreateOrderParams and CreateWithdrawalParams
• If Some(addr), final token transfer goes to addr instead of env.invoker()
• If None, behaviour unchanged
• recipient address is not auth-checked — position owner has full discretion

Security Note

The recipient cannot use this to steal funds from a different owner. The position auth check still applies to the invoker, not the recipient.

Acceptance Criteria

• CreateOrderParams and CreateWithdrawalParams include recipient: Option<Address>
• Token transfer uses recipient when set
• Integration test: close position with recipient = cold_wallet, assert cold_wallet receives PnL
• Integration test: None recipient sends to invoker (no regression)

Affected Contracts

exchange_router, order_handler, withdrawal_handler

[Hassanmovic98]

I'll add a recipient field to decrease and withdrawal orders so traders can direct funds to a different wallet — cold storage, multi-sig, whatever.
If recipient is set, the final token transfer goes there instead of the invoker. If None, unchanged — funds go to the original owner. Recipient doesn't need auth because the position owner controls this field, not the recipient.
Integration tests verify: close position with recipient set, cold wallet receives PnL. None recipient sends to invoker as before.

[Hassanmovic98]

I'll add a recipient field to decrease and withdrawal orders so traders can direct funds to a different wallet — cold storage, multi-sig, whatever.

If recipient is set, the final token transfer goes there instead of the invoker. If None, unchanged — funds go to the original owner. Recipient doesn't need auth because the position owner controls this field, not the recipient.

Integration tests verify: close position with recipient set, cold wallet receives PnL. None recipient sends to invoker as before.

[ogbesylvester0-gif]

@ogbesylvester0-gif has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello maintainer I'll like to work on this issue please can you assign me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ogbesylvester0-gif to this issue.