[CRITICAL][SOROBAN AUTHORITY] Secure contract initialization and authorize the canonical pool registry #163

Summary

Pool creation is currently self-authorized by the caller, while the repayment contract initializer stores an administrator without requiring that administrator's authorization. This leaves deployment and global pool-ID ownership without a canonical trust boundary.

Repository evidence

• contracts/repayment/src/lib.rs initializes and stores the admin without calling admin.require_auth().
• contracts/chainmove-pool/src/lib.rs lets any caller self-authorize as owner and create a globally keyed DataKey::Pool(pool_id).

Scope

• Introduce an authenticated bootstrap/factory authority for initialization and pool creation.
• Bind pool IDs to the canonical registry/factory and emit authority/version metadata in creation events.
• Define a one-time initialization path that cannot be replayed or taken over.

Acceptance criteria

• Unauthorized initialization and direct pool creation fail deterministically.
• The configured factory/admin must authorize every bootstrap or pool-registration transition.
• Existing authorized flows remain usable through an explicit migration/compatibility path.

Tests

• Unit tests for missing, wrong, and valid bootstrap authorization.
• Property/integration tests proving a pool ID cannot be preempted by an unrelated account.

Non-goals

• Redesigning pool economics or the repayment schedule.