feat(dos): implement denial-of-service, gas-griefing, and unbounded-work analysis (#80)

[covenantalade]

Summary

Closes #80

Implements a comprehensive, production-grade Denial-of-Service (DoS), Gas-Griefing, and Unbounded-Work Analysis   

engine for ChainProof/StellarChainproofs.

### Architecture & Features                                                                                       
1. **Loop & Bound Analysis (`packages/core/src/dos/loop-analyzer.ts`)**:                                          
   - AST-based loop bounds extraction and symbolic bounds estimator (`storage_array_bounded`, `parameter_bounded`,

constant_bounded, paginated, unbounded).
- Tracks side-effects in loop bodies (state writes, storage deletes, call fan-outs, return bombs, event
emissions).
2. Call Fan-Out & Push Payment Detection (packages/core/src/dos/call-fanout.ts):
- Identifies high-risk push-payment patterns, value transfers, low-level .call, return bombs
(returndatacopy), and 63/64th gas forwarding issues.
3. Array Growth & Storage Poisoning (packages/core/src/dos/growth-analyzer.ts):
- Detects public/unprotected .push() endpoints on storage arrays iterated across contracts.
4. Mitigation Evidence Recognition (packages/core/src/dos/mitigation-detector.ts):
- Recognizes pull-payment workflows, pagination (offset/limit), explicit length caps (require(len <= MAX)), failure isolation, and checkpoint state machines.
5. Rule Suite (CP-DOS-001 through CP-DOS-010):
- CP-DOS-001: Unbounded Loop Iteration over Dynamic Storage
- CP-DOS-002: Push-Payment Pattern with Unexpected Revert Risk (SWC-113)
- CP-DOS-003: External Call Fan-Out in Loop Body
- CP-DOS-004: Returndata Memory Bomb / Griefing Risk
- CP-DOS-005: Unbounded Storage Clearing / Mass Deletion
- CP-DOS-006: Insufficient Gas Forwarding (63/64th Rule)
- CP-DOS-007: Single-Transaction Block Gas Limit Deadlock
- CP-DOS-008: Unbounded Recursion (SWC-107)
- CP-DOS-009: Array Poisoning / Unconstrained Growth
- CP-DOS-010: Revert Propagation in Batch Operations
6. CLI Commands & Server Endpoints:
- CLI: chainproof dos inspect-loops, fanout, audit (--format table|json|markdown, --fail-on).
- REST API: POST /dos/inspect-loops, POST /dos/fanout, POST /dos/audit with OpenAPI v3 docs.
7. Fixtures & Documentation:
- Added 9 vulnerable and secure Solidity fixtures in examples/contracts/dos/.
- Comprehensive guide in docs/dos-analysis.md.

### Verification
- `npm run lint`: Passed (0 errors).
- `npm run build`: Passed across all workspaces.
- `npm test`: Passed (all test suites in `@chainproof/core` and `@chainproof/cli`).
- `npm run test:ci --workspace=packages/core`: Passed (50 test suites, 372 tests).

[Nanle-code]

@covenantalade nice work here