feat(contract): add bounded withdrawal limits and anti-drain policy (#77)

[woahwhattheheck]

Summary

Closes #77.

Adds bounded withdrawal / anti-drain controls so a compromised caller or integration bug cannot drain a vault faster than operators can respond.

Behavior

• Units: underlying assets (u128). 0 for either cap means unlimited (default), so existing flows stay permissive until configured.
• Per-operation cap (max_per_op): each single withdraw and each withdraw_batch leg must redeem ≤ this amount.
• Rolling-period cap (max_per_period + period_secs): aggregate redeemed assets in the current ledger-timestamp window; window auto-rolls when elapsed ≥ period_secs.
• withdraw_batch: validates every leg and the sum against the period aggregate before any burn/transfer, so splitting cannot bypass the period limit. Empty batch → EmptyBatch.
• Admin controls (auth-tested, evented):
  • set_withdraw_limits(max_per_op, max_per_period, period_secs) → wd_limits
  • reset_withdraw_period() → wd_reset (clears usage, starts window at now)
  • set_withdraw_limits_override(enabled) → wd_override (skips checks; does not record usage)
• Over-limit attempts fail atomically (no partial state) with WithdrawLimitExceeded / WithdrawPeriodLimitExceeded.
• On-chain version() bumped to 3 (same major bump as sibling PRs; does not regress below 3).

Design tradeoff

Kept the change thin and high-confidence: shared enforce_withdraw_limits + one batch entrypoint, rather than a custody redesign or per-user rate limiter. Defaults remain unlimited so integrators opt in by setting caps.

Tests

cargo test --locked
# 60 passed; 0 failed; 3 ignored (pre-existing)
cargo fmt --all -- --check
cargo clippy --lib --locked -- -D warnings

Coverage added for: default unlimited, per-op boundary, period aggregate + window roll, batch cannot bypass period, batch per-op leg + empty batch, concurrent users sharing period budget, admin reset/override events + auth path, invalid period config, version 3.

Compatibility

Additive API + four new error codes. Happy-path withdraws with default (unlimited) limits behave as before. Integrators that configure caps must handle the new errors; version() is now 3.