feat: harden pause and resume authorization (#152)

[s6pa1rta3n-lab]

Summary

Closes #152

This pull request centralizes pause policy, hardens authorization across pause/resume lifecycles, and introduces a full entrypoint-matrix test suite covering all state transitions and recovery paths.

Acceptance Criteria Checklist

• Value-moving calls pause as intended: Settle operations (settle_stream and batch_settle) on paused streams return 0 and deduct zero value from the remaining balance (tests/issue152_pause_resume_matrix.rs:test_settle_stream_while_paused_moves_zero_value, test_batch_settle_while_paused_moves_zero_value).
• Recovery paths are explicit and authorized: Emergency cancellations (cancel_stream) and stops (stop_stream) while paused are strictly reserved for the stream payer via require_auth() and cleanly terminalize the stream (tests/issue152_pause_resume_matrix.rs:test_recovery_path_cancel_while_paused, test_recovery_path_stop_while_paused, test_unauthorized_recovery_paths_rejected, test_non_payer_role_transition_isolation).
• Resume cannot reset balances or timestamps: Resuming a paused stream preserves the unaccrued balance, advances start_time to the current ledger timestamp, clears paused_at, and handles terminalization if the schedule ended while paused (tests/issue152_pause_resume_matrix.rs:test_resume_preserves_balance_and_updates_start_timestamp, test_multiple_pause_resume_cycles_strictly_conserve_balance, test_resume_on_stream_past_natural_end_is_terminal).
• Entrypoint-matrix tests cover mutations: Comprehensive mutation matrix tests verifying all contract entrypoints against unstarted, active, paused, stopped, and cancelled states (tests/issue152_pause_resume_matrix.rs:test_entrypoint_matrix_unstarted_stream, test_entrypoint_matrix_active_stream, test_entrypoint_matrix_paused_stream, test_entrypoint_matrix_stopped_terminal_stream, test_entrypoint_matrix_cancelled_terminal_stream, test_rapid_toggle_at_same_timestamp).

Security & Failure Mode Considerations

• All state-modifying functions enforce strict caller authentication (info.payer.require_auth()).
• Settle and batch settle operations respect the effective accrual boundary accrual_bound(now, end_time, paused_at) ensuring no double crediting or unearned token movement occurs during pause intervals.
• Resuming a stream past its configured end_time transitions the stream directly to an inactive terminal state without resurrecting accrual.
• Saturation arithmetic (saturating_mul, saturating_sub, .min(balance)) protects against integer overflow.

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC