Feat/liquidity pool audit

[ryzen-xp]

Pull Request

Description

This PR addresses all critical, high, medium, and low severity findings from the recent security audit of the liquidity-pool-contract. It hardens access control, corrects accounting logic, implements an emergency pause mechanism, and ensures storage TTLs are properly managed to prevent contract archival.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Changes Made

• [C-1] Secured distribute_interest with strict require_auth and caller identity verification (Admin/CreditLine only).
• [H-1 & H-2] Created access.rs to standardize administrative gating and updated set_admin to comply with Soroban auth patterns.
• [H-3 & H-4] Fixed the receive_guarantee accounting mismatch and enforced MIN_AMOUNT on deposits.
• [M-1 & M-2] Added public read accessors for token, treasury, merchant fund, and creditline addresses.
• [M-3 & M-4] Implemented TTL extensions (bump_instance and bump_lp_shares) across all state-mutating and relevant read functions to prevent state expiration.
• [M-5] Added a comprehensive emergency pause mechanism (pause, unpause, is_paused) blocking all state-mutating operations when active.
• [L-1 & L-3] Cleaned up unused constants and removed unsafe { core::mem::transmute } from test helpers, replacing it with safe, lifetime-bound client generation.

Testing

• Tests pass locally (85/85 tests passing)
• New tests added (8 new tests added specifically covering the pause/unpause mechanism and authorization failures)

Checklist

• Code follows project style guidelines

• Self-review completed

• Comments added for complex code

• Documentation updated (constants and new error codes)

• No new warnings generated

• Close [FEATURE] SC-15: Implement deposits to the Liquidity Pool #70