feat: add bidder refund claims and security docs

[prissca]

Summary

• add a self-service claim_bid_refund path for unsuccessful bidders after winner selection
• emit a typed bid refund claim event and cover winner/loser refund behavior with tests
• add responsible disclosure, threat model, and health/shutdown operator documentation

Closes #355
Closes #354
Closes #353
Closes #349

Tests

• cargo fmt
• cargo test -p agent-bidding (blocked locally: MSVC linker link.exe is not installed)

[drips-wave]

@prissca Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@Obiajulu-gif is attempting to deploy a commit to the Jaja's projects Team on Vercel.

A member of the Team first needs to authorize it.