[VBmedic757]

Adds regression coverage and documentation for the existing initialization authorization boundary.

initialize already calls admin.require_auth() in the base source. This patch preserves that behavior; it does not add a new runtime authorization guard or bind initialization to the deployer.

• Tests that initialization without the proposed administrator's authorization fails with a host/auth error and leaves the vault uninitialized.
• Tests that an authorized call records exactly the proposed administrator's authorization, succeeds once, and rejects re-initialization with AlreadyInit.
• Documents the signature requirement and its deployment limitation in the contract README and testnet deployment notes. A caller controlling its own proposed administrator can still initialize first; initialize promptly after deployment and verify the deployed version.

Automated validation passed for this exact patch:

git diff --check
cargo test --manifest-path contracts/yield_vault/Cargo.toml --offline --locked -p yield_vault
cargo clippy --manifest-path contracts/yield_vault/Cargo.toml --offline --locked -p yield_vault --all-targets -- -D warnings

AI assistance was used for this change and automated validation. The account owner selected the intended policy: require the chosen administrator's signature without restricting initialization to the original deployer. This does not assert that the owner personally ran these checks or reviewed the code.