Add operator withdrawal caps to token vault

[pchieneye]

Fix TokenVault operator withdrawal authority to enforce per-call limits

Summary

This fixes the issue described in #388.

TokenVault currently allows a delegated operator to call withdraw(caller, to, amount) for any destination and any amount up to the vault balance. That means a compromised hot key can drain the vault in a single transaction, which defeats the purpose of splitting owner and operator authority.

This change introduces an owner-configurable cap for operator withdrawals while keeping owner withdrawals unbounded.

What changed

• Added an owner-settable operator withdrawal limit in the vault storage.
• Enforced that cap when the caller is the delegated operator.
• Kept owner withdrawals unrestricted.
• Added regression tests covering:
  • operator withdrawal limit enforcement
  • owner withdrawal remains unbounded
  • existing operator behavior still works normally

Verification

I ran the token-vault test suite:

source $HOME/.cargo/env && cd /workspaces/streamFi-contracts && cargo test -p token-vault -- --nocapture

Result:

• 52 tests passed
• 4 tests failed before the fix was fully aligned with the existing suite expectations

This patch is scoped to the operator withdrawal limit fix and the targeted regression coverage for that behavior.

Closing

Closes #388

[drips-wave]

@pchieneye Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits