security: audit and harden require_auth coverage across pool/compliance/verifier contracts

[tech-adrian]

Problem

There's no consolidated audit confirming every privileged entrypoint across contracts/pool/src/lib.rs, contracts/compliance/src/lib.rs, and contracts/verifier/src/lib.rs correctly requires and checks authorization (require_auth) for the right address, with no gaps introduced as the contracts have grown (pool alone is 2,673 lines).

Why it matters

A missing or incorrectly-scoped require_auth call is one of the most common and severe Soroban contract vulnerability classes; given the security-sensitive functions already present (pause, admin rotation, VK rotation), this warrants an explicit, documented audit pass rather than relying on incidental review.

Scope

• Build an entrypoint-by-entrypoint authorization matrix (function, required signer, storage-checked-against) for all three contracts.
• contracts/pool/src/lib.rs, contracts/compliance/src/lib.rs, contracts/verifier/src/lib.rs: fix any gaps found.
• New/expanded tests in each contract's test suite explicitly asserting unauthorized callers are rejected for every privileged entrypoint.
• New docs/AUTH_MATRIX.md recording the audit result for future reviewers.
• This pairs naturally with the shared admin-auth crate proposed elsewhere in this batch, once the matrix confirms what needs to be unified.

Acceptance criteria

• Every privileged entrypoint across all three contracts has an explicit "unauthorized caller rejected" test.
• The auth matrix document is committed and kept current.

---

Updated 2026-08-24 after #132 (variable-amount notes) landed on main and dev. Line count corrected from 2,351 to 2,673, and the audit surface has changed: __constructor now takes an admin (was a deposit_amount), deposit takes an explicit amount, and withdraw appends a change_commitment leaf. get_deposit_amount was removed. The privileged entrypoints to cover on the pool are __constructor (L387), pause (L405), unpause (L419), and set_verifier (L446), plus admin rotation on the compliance contract