feat(contract): add bounded withdrawal limits and anti-drain policy

[arisu6804]

Problem

A compromised caller or integration bug could drain a vault rapidly before operators can respond.

Objective

Deliver a production-quality improvement to withdrawal authorization and liquidity controls that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Define per-operation and rolling-period withdrawal limits with explicit units and authority.
• Make limits apply consistently to direct and batched withdrawals.
• Provide an auditable reset or emergency override with strict authorization.

Acceptance criteria

• Withdrawals over the configured limit fail atomically.
• Batch operations cannot bypass the aggregate limit.
• Limit changes and overrides are emitted and authorization-tested.

Required validation

• Boundary, batch, reset, override, and concurrent-withdrawal tests.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused on this issue and explain design tradeoffs.
• Include test evidence, compatibility impact, and migration or rollout notes where relevant.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.