[Cmitchelle7]

Verification

CI on my fork ran green: rustfmt, clippy -D warnings, cargo test -p yield_vault,
the wasm build, and the TypeScript typecheck, lint, format check and tests
(<link to the green run on Cmitchelle7/yield-general>).

Not covered by CI: a live Testnet deploy. deploy-yield-vault.ts and
deploy-yield-vault.sh now pass the salt to initialize, but I have not run
them against Testnet, and the shell path relies on stellar contract deploy --salt and passing a hex BytesN<32> argument.

[Cmitchelle7]

Hi this PR is ready for review.

What it does: it implements option 2 from the issue, binding initialize to the
deploying account. The existing admin.require_auth() only stops a caller from
installing an admin it doesn't control, so a front-runner could still name itself admin
and sign its own call. initialize now takes the deployer and the creation salt,
re-derives the contract address from them, and rejects the call with BadDeployer unless
it matches the vault's own address. The deployer must sign. AlreadyInit behaviour is
unchanged, and there's no SDK bump or constructor.

Verification: CI is green on my fork, covering rustfmt, clippy -D warnings,
cargo test -p yield_vault, the wasm build, and the TypeScript typecheck, lint, format
check and tests: <link to the green run on Cmitchelle7/yield-general>.

The workflows on this PR are waiting for maintainer approval because I'm a first-time
contributor. Could you approve them so the checks run here too?

Not covered by CI: a live Testnet deploy. Both deploy scripts now pass the salt
through to initialize, but I haven't run them against Testnet. The shell path relies on
stellar contract deploy --salt and passing a hex BytesN<32> argument.

Note: this changes the initialize ABI (callers now pass deployer and salt). The
Testnet vault in docs/deployment/testnet.md was deployed earlier and is already
initialized, so it's unaffected, and the doc says so.