[CRITICAL][SOROBAN AUTHORITY] Secure contract initialization and authorize the canonical pool registry

[Obiajulu-gif]

Summary

Pool creation is currently self-authorized by the caller, while the repayment contract initializer stores an administrator without requiring that administrator's authorization. This leaves deployment and global pool-ID ownership without a canonical trust boundary.

Repository evidence

• contracts/repayment/src/lib.rs initializes and stores the admin without calling admin.require_auth().
• contracts/chainmove-pool/src/lib.rs lets any caller self-authorize as owner and create a globally keyed DataKey::Pool(pool_id).

Scope

• Introduce an authenticated bootstrap/factory authority for initialization and pool creation.
• Bind pool IDs to the canonical registry/factory and emit authority/version metadata in creation events.
• Define a one-time initialization path that cannot be replayed or taken over.

Acceptance criteria

• Unauthorized initialization and direct pool creation fail deterministically.
• The configured factory/admin must authorize every bootstrap or pool-registration transition.
• Existing authorized flows remain usable through an explicit migration/compatibility path.

Tests

• Unit tests for missing, wrong, and valid bootstrap authorization.
• Property/integration tests proving a pool ID cannot be preempted by an unrelated account.

Non-goals

• Redesigning pool economics or the repayment schedule.

[devfoma]

Hello, I would love to take on this issue. I'm a software engineer with over 4 years experience. and i'm confident I can resolve this issue

[grantfox-oss]

🦊 GrantFox — @devfoma has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #163)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@devfoma's PR #212 was approved and merged by @Obiajulu-gif.

🏆 @devfoma: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,222 total points). Track your full progress on GrantFox.

👏 Great work, @devfoma! Keep contributing to Chainmove.