test: pin Stream layout and cover depletion, fee TTL, drained streams

[Asta-wizard]

closes #302
closes #300
closes #299
closes #298

Added the four requested test suites to OracleDesk's sibling project
streamgive-contracts: a pinned Stream storage-layout guard plus a test
proving the previous layout is not decodable, proptests for
seconds_to_deplete, a per-token fee override test that crosses the instance
TTL, and drained-stream coverage for modify_rate/top_up. No production
behaviour was changed for the four issues; the suite does document the current
drained-stream semantics.

Verification

Run with Rust 1.95.0:

• cargo fmt --check — clean.
• cargo clippy --all-targets --all-features — no errors (only pre-existing
  warnings in both crates).
• cargo test --workspace — all green:
  • donation-vault unit tests: 192 passed, 1 ignored.
  • ngo-registry unit tests: 48 passed, 1 ignored.
  • donation-vault doc tests: 370 passed.
  • ngo-registry doc tests: 160 passed.

New tests:

• test::stream_storage_layout_is_pinned — asserts the encoded ScMap field
  keys equal the STREAM_FIELDS list; any field add/remove/rename/reorder
  fails until the list and compatibility test are updated.
• test::previous_stream_layout_is_not_decodable_by_current_code — writes the
  8-field pre-cancelled/status layout as raw Val and asserts the current
  code cannot produce a Stream from it.
• math::test::positive_balance_never_depletes_in_zero_seconds,
  math::test::monotonic_in_balance,
  math::test::accrued_matches_depletion_time — proptests for Add property tests for seconds_to_deplete #300.
• test::token_fee_override_survives_instance_ttl_advance — Add tests for per-token fee overrides surviving TTL expiry #299.
• test::modify_rate_and_top_up_on_a_drained_stream — Add tests for modify_rate and top_up on a drained stream #298.

---

#302 — Guard the Stream storage layout

• Added STREAM_FIELDS with the ten current contract-type field names and a
  test that decodes a sample Stream to ScVal, extracts the ScMap symbol
  keys and compares them to that list.
• Added a compatibility test that builds the previous 8-field layout
  (donor, ngo, token, rate, balance, withdrawn, created_at, last_update) as a
  raw Map<Symbol, Val> under DataKey::Stream(999). The current code cannot
  read it (the get_stream invocation either reports StreamNotFound or
  aborts at host decode); the test asserts no Stream value is produced and
  documents that migration/versioning would be required to read old entries.

#300 — Proptests for seconds_to_deplete

Added three proptest! properties over bounded positive rate/balance:

• a positive balance at a positive rate never returns Some(0);
• depletion time is monotonic in balance for a fixed rate;
• accrued(rate, seconds, balance) == balance at the returned time and
  < balance one second earlier.

#299 — Per-token fee override after TTL advancement

The test configures treasury, a 5% global fee and a 1% token override, creates
a stream, advances the ledger sequence by INSTANCE_BUMP_AMOUNT + 1 (past the
instance entry's full TTL) and the timestamp by 50s, then asserts:

• token_fee_bps(token) is still 100;
• pending_payout uses 5/495 (1%/99%), not the 5% global fee;
• withdraw pays 5 to the treasury and 495 to the NGO.

#298 — modify_rate/top_up on a drained stream

Drains a 1,000-unit stream at 10/s, then pins the current behavior:

• modify_rate succeeds (a drained stream is not cancelled), updates the
  rate, and leaves status = Drained with zero balance;
• top_up succeeds, adds balance, and also leaves status = Drained;
• the topped-up balance accrues at the new rate (200 after 10s at 20/s).

---

Judgement calls

1. Pre-existing compile blockers had to be fixed first. The checkout did
   not compile before these tests:

   • ngo-registry was missing Vec in its imports;
   • donation-vault's upgrade_preserves_state test was truncated mid-body
     (restored from commit bca0aff);
   • tests called a streams_by_donor view that did not exist (restored as a
     read-only pass over stream records);
   • two event tests used ContractEvents::len() instead of
     .events().len().

2. Stale tests were updated to the current fee policy. Several tests
   expected set_fee_bps/set_token_fee_bps/clear_treasury to work without
   a treasury even though the contract now rejects that (FeeRequiresTreasury).
   They now set a treasury first and zero the fee before clearing it. This is
   test maintenance, not a production change.

3. Two upgrade-auth tests are ignored, not deleted. upgrade calls
   update_current_contract_wasm, which aborts before env.auths() is
   observable when the test passes a synthetic wasm hash. They are marked
   #[ignore = "requires an uploaded wasm hash; upgrade panics before auth is observable"]; the existing upgrade_fails_with_unuploaded_wasm_hash and
   upgrade_preserves_state tests still cover the failure and state paths.

4. cargo fmt touched unrelated lines. Running cargo fmt reformatted
   three pre-existing long lines in lib.rs and a few comment indents; without
   that, cargo fmt --check (required by the issues) would still fail.

5. Cargo.lock gained ngo-registry under donation-vault. The lockfile
   was stale relative to the existing dev-dependency; cargo test updated it.
   No new external dependency was added (proptest was already a dev-dependency).

6. No branch/PR flow was skipped. All four issues target main, which is
   this repository's default branch. Work was committed directly to main as
   requested by INSTRUCTIONS.md; no other branches existed to delete.

[drips-wave]

@Asta-wizard Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits